Field reportThe Source Code
Comes Back.

1. 1984
   Phoenix clean-room BIOS. One team writes a specification of IBM's BIOS; a separate team that never saw the code implements it. The PC-compatible industry follows.AFBF0014 8FBF0014 27BD0018 0085102B AFB00010 8FBF0014 3C01800F AFB00010 27BD0018 27BD0018 AFB00010 8FB00010 AFB00010 03E00008 27BDFFE8 27BD0018 0C01A2F4 00000000 24844C10 AFB00010 AFBF0014
2. 1992
   Sega v. Accolade. A US appeals court holds that disassembling code to reach its functional elements can be fair use. ²⁵00801025 8FB00010 27BDFFE8 3C01800F 27BDFFE8 10400003 0C0234B8 3C01800F 27BD0018 0C0234B8 24844C10 03E00008 8FBF0014 8FB00010 3C01800F 8FB00010
3. 2000
   Sony v. Connectix. Copying the PS1 BIOS during development of an emulator is ruled fair use. Sony loses. ²⁶8FB00010 3C048034 0C01A2F4 AFBF0014 0C0234B8 8FBF0014 8FBF0014 27BD0018 8FB00010 0C0234B8 27BD0018 8FBF0014 8FB00010 3C01800F
4. 2019
   The NSA open-sources Ghidra, and the Super Mario 64 matching decompilation goes public. A PC port follows the next year.8FBF0014 27BD0018 3C048034 0085102B 0085102B 24844C10 24844C10 AFBF0014 AFBF0014 AFB00010 8FBF0014 00801025 AFBF0014 27BDFFE8 0C01A2F4 8FB00010
5. 2021 to 2022
   Ocarina of Time reaches 100% after about two years of volunteer work; Ship of Harkinian becomes the reference port. ⁵00801025 0C01A2F4 03E00008 10400003 27BD0018 27BD0018 03E00008 8FBF0014 27BD0018 3C048034 0C0234B8 24844C10 0C01A2F4 8FB00010 8FBF0014 AFBF0014
6. 2024
   Zelda 64: Recompiled shows off N64 static recompilation: translating machine code without fully understanding it.3C048034 8FB00010 27BDFFE8 00000000 00801025 AFBF0014 3C048034 00000000 24844C10 8FBF0014 27BD0018 0C0234B8 03E00008 24844C10 00000000
7. 2025 to 2026
   "The unexpected effectiveness of one-shot decompilation with Claude." Chris Lewis leaves Claude matching Snowboard Kids 2 functions unattended for 8+ hours at a stretch, and makes more progress in three weeks than in the previous three months. ³¹8FBF0014 00801025 8FB00010 0085102B 0C01A2F4 3C01800F 0C01A2F4 8FBF0014 00801025 00801025 00000000 0C0234B8 27BDFFE8 24844C10 10400003 00000000 0C0234B8 8FB00010 24844C10 00801025 27BD0018 0085102B 8FBF0014 24844C10 0085102B 03E00008 AFB00010 10400003 8FB00010 3C048034 27BDFFE8 3C01800F
8. Early 2026
   Opus 4.6 and GPT-5.4. Models already know the community's tools without being told, but results need heavy cleanup and are expensive. ¹27BDFFE8 3C01800F 0C01A2F4 24844C10 24844C10 0085102B 00801025 0C01A2F4 10400003 24844C10 0C01A2F4 00000000 3C048034 27BD0018 0C01A2F4 27BDFFE8 00801025 27BD0018
9. Aug 2026
   Snowboard Kids 100% matched in 84 days. Pilotwings 64 did it in about 74. ¹²8FB00010 8FBF0014 27BDFFE8 0085102B 3C01800F 0085102B 0085102B 8FBF0014 27BD0018 8FBF0014
10. Sep to Oct 2026
    The flood. GPT-6-Astra-class agents, REA passes 100k GitHub stars, ArtCraft's Adobe clones go viral, the Relapse PS5 jailbreak lands, and decomp.dev closes its public index. ^{1 4 14 17}27BD0018 00000000 00801025 3C048034 0C01A2F4 8FBF0014 27BDFFE8 8FB00010 AFB00010 3C01800F 10400003 3C01800F 3C01800F 00000000 27BDFFE8 8FBF0014 27BDFFE8 AFB00010 8FB00010 0C0234B8 3C01800F 3C048034 00000000 3C048034 00801025

1. Step 1 mechanicalDisassemble
   Bytes become assembly, one CPU instruction per line. Fully deterministic.8FB00010 8FBF0014 AFB00010 00801025 0C0234B8 8FB00010 3C048034 03E00008 27BDFFE8 AFB00010
2. Step 2 toolsDecompile
   Ghidra or IDA lift the assembly into noisy, C-shaped pseudocode.03E00008 AFBF0014 0085102B 0C0234B8 3C01800F 3C01800F 0085102B 00000000 00801025
3. Step 3 AI nowRecover meaning
   Names, structs, types and which subsystem a function belongs to. Historically the slow human part.3C048034 27BDFFE8 10400003 0C01A2F4 10400003 00000000 0C01A2F4 27BDFFE8 10400003 3C048034 3C01800F 3C01800F 27BDFFE8
4. Step 4 AI and humanRefactor
   Turn it into code someone can maintain, port or mod.8FBF0014 27BD0018 8FBF0014 AFB00010 AFB00010 27BD0018 8FBF0014

Three goals that get mixed up

Why the compiler is the judge

The leap forward isn't a model that reads raw bytes and writes perfect source. Models trained to do that end to end still score modestly. ⁷ It's an agent placed inside a closed feedback loop. The agent proposes C, the project's historical compiler builds it, and a differ reports exactly which instructions don't match. Hallucinations get rejected automatically, because the compiler doesn't care how convincing the code looks.03E00008 AFBF0014 8FBF0014 10400003 27BD0018 AFB00010 27BDFFE8 03E00008 24844C10 27BDFFE8 8FBF0014 3C01800F 3C01800F 10400003 03E00008 0085102B 03E00008 3C048034 27BDFFE8 0C01A2F4 10400003 27BD0018 AFBF0014 24844C10 00000000 00000000 8FBF0014 0C0234B8 0C01A2F4 0C01A2F4 0085102B 0C01A2F4 3C01800F 0C01A2F4 8FBF0014 0C0234B8 8FB00010 3C048034 0C0234B8 3C01800F 10400003 27BD0018 0085102B 0085102B 0C01A2F4 10400003 00801025 3C048034 27BDFFE8 3C048034 0C01A2F4 0085102B 8FB00010 AFBF0014 0C0234B8

The exact toolchain matters. Snowboard Kids 2 was built with GCC 2.7.2, while the original Snowboard Kids used SGI's proprietary IDO 5.3. IDO's multi-pass optimiser means "tiny changes to the C can produce a completely different register allocation." ¹² The community had to statically recompile IDO just to run it on modern PCs.AFBF0014 27BDFFE8 3C048034 0C01A2F4 0C01A2F4 8FB00010 8FB00010 03E00008 0C0234B8 10400003 24844C10 00000000 8FBF0014 24844C10 8FBF0014 3C048034 AFBF0014 27BD0018 3C048034 AFBF0014 0C0234B8 27BD0018 3C048034 27BD0018 0C0234B8 27BDFFE8 00000000 AFBF0014 3C01800F 00801025 03E00008 0085102B 27BDFFE8 0085102B 8FBF0014 00801025 3C048034 3C01800F 27BDFFE8 00000000 00000000 0085102B 00801025

According to the maintainer of decomp.dev, the newest models are "exceptionally good permuters." They write their own small scripts that try many source variants across files and headers until one lines up. ¹ Older models tended to cheat instead, producing code that matched the bytes but that no human programmer of the era would have written.27BD0018 3C01800F 8FBF0014 3C048034 24844C10 0C0234B8 24844C10 AFB00010 24844C10 27BDFFE8 AFB00010 8FB00010 00801025 10400003 8FBF0014 0085102B AFB00010 0C0234B8 03E00008 00801025 00801025 0C01A2F4 10400003 AFBF0014 27BD0018 8FBF0014 27BDFFE8 8FB00010 8FBF0014 27BDFFE8 10400003 8FB00010 10400003 24844C10 03E00008 10400003 3C048034 00801025 0C01A2F4 10400003 10400003 8FBF0014 AFBF0014 00801025 24844C10

sltu $v0, $a0, $a1   # unsigned <
jr   $ra
nop                 # delay slot

int is_less(int a, int b) {
    return a < b;  /* emits slt */
}

int is_less(unsigned int a,
            unsigned int b) {
    return a < b;  /* emits sltu */
}

A typical session

1. Start from a project that builds. Splat config, symbols, and the exact compiler and flags already identified.8FB00010 00801025 3C048034 AFB00010 27BD0018 0085102B 3C01800F 0C0234B8 AFB00010 8FBF0014 8FB00010 0C0234B8 3C01800F 3C01800F
2. Pick the next target. Usually the smallest unmatched function. The agent gets its own scratch directory.00801025 27BD0018 27BDFFE8 00801025 3C048034 8FB00010 AFBF0014 AFB00010 00801025 00000000 0C01A2F4 27BDFFE8 00000000 27BDFFE8
3. Iterate. Write several candidates, compile, diff, adjust types, ordering and signatures.3C01800F 8FBF0014 0085102B 3C048034 00801025 8FB00010 3C01800F 10400003 8FBF0014 0C01A2F4 27BD0018 0C0234B8
4. Integrate and rebuild everything. Lewis's CLAUDE.md rejects a match until the full ROM checks out. ¹⁰3C048034 0085102B 0085102B 00801025 0C0234B8 8FB00010 0C01A2F4 0085102B 24844C10 27BD0018 27BDFFE8 27BDFFE8 AFBF0014 0C01A2F4
5. Hand the long tail to humans. The hardest functions, naming, structs and review. ¹¹10400003 00000000 00000000 24844C10 0085102B 0C01A2F4 00801025 03E00008 27BD0018 03E00008 00801025

What it costs

Tokens

REA's own benchmark: analysing SQLite compiled to WASM took 42 tool calls, about 5 minutes and about 300k input tokens. ⁵27BDFFE8 0085102B 27BD0018 8FB00010 24844C10 27BD0018 AFB00010 0C0234B8 0C0234B8 AFBF0014 27BD0018 24844C10 10400003 24844C10 8FBF0014 3C01800F

Context

REA's tool catalogue alone is 2.3 MB of JSON. Inspecting one Mac app can return 80k to 230k tokens. ⁵24844C10 24844C10 0085102B 8FBF0014 27BDFFE8 0C01A2F4 0C0234B8 0C0234B8 00801025 27BDFFE8 8FB00010 3C01800F 00000000 AFB00010

Expertise

Even in the 84-day run, about 1 in 20 matching commits needed a specialist. ¹²3C01800F AFB00010 10400003 8FB00010 8FB00010 00000000 3C01800F 00000000 24844C10 27BD0018 8FBF0014

Self-imposed limits

REA's contribution rules exclude breaking DRM, anticheat and licensing protections. ⁵AFB00010 0C0234B8 10400003 AFBF0014 00000000 00801025 8FB00010 AFBF0014 3C01800F 3C01800F 10400003 0C01A2F4

Through 2026, unofficial ports have shown up faster than anyone can list them. A community spreadsheet tracks about a hundred and is always behind. Arcade Time Crisis and Daytona USA, Bloodborne, and the Xbox One version of Forza Horizon 2 running on Windows have all been reported. ⁵ Mashups like Mario dropped into Elden Ring circulate alongside serious preservation work, often running in a browser via WebAssembly. ^{2 3} One outlet reports that Super Smash Bros. Melee reached 100%, with AI finishing the last stretch. That's a single-source claim. ²⁹10400003 8FBF0014 03E00008 10400003 AFBF0014 00801025 27BD0018 AFB00010 0085102B 3C01800F 00801025 24844C10 8FB00010 00801025 10400003 00000000 AFB00010 27BDFFE8 8FB00010 10400003 10400003 AFBF0014 8FBF0014 0C0234B8 8FB00010 00801025 8FBF0014 3C048034 0C0234B8 27BD0018 27BDFFE8 10400003 0C01A2F4 00801025 0085102B 00000000 3C01800F 8FBF0014 00801025 0C01A2F4 27BDFFE8 0085102B 8FB00010 0085102B 8FBF0014 3C048034 03E00008 0C0234B8 27BD0018 AFB00010 8FB00010 03E00008 0C01A2F4 24844C10 AFBF0014 8FBF0014 8FBF0014 00000000 24844C10 03E00008 8FB00010 10400003 27BD0018 8FBF0014 3C048034 10400003 24844C10 00000000 0C01A2F4 AFBF0014 8FB00010 8FB00010

The Snowboard Kids numbers are the most useful data point because the author published them himself. The game took 84 days, against 596 for its sequel. Lewis warns that attributing the difference purely to LLMs "would be a gross oversimplification": he had two years of experience by then, and expert collaborators stepped in on about 4.8% of commits. ¹²27BDFFE8 00000000 27BD0018 0C01A2F4 0085102B 27BD0018 3C01800F AFB00010 0085102B 0C0234B8 AFB00010 8FB00010 8FBF0014 0C01A2F4 0085102B 3C048034 0C01A2F4 10400003 8FB00010 8FBF0014 3C01800F 00000000 0C0234B8 8FBF0014 AFB00010 3C01800F 24844C10 24844C10 00000000 AFBF0014 27BDFFE8 0C01A2F4 8FBF0014 10400003 00801025 0C01A2F4 0C0234B8 27BDFFE8 AFB00010 8FBF0014 0C0234B8 0C01A2F4 03E00008 00000000 0085102B 3C048034

Then came the backlash. In mid-October the maintainer of decomp.dev, the community's progress tracker for matching-decomp projects, disabled its main index and stopped accepting new projects. ^{1 2} The complaint isn't AI itself. It's three specific behaviours: hostile forks that "finish" human-led projects with AI, opportunists racing to ship half-working ports built on other people's decomps, and the blurring of "decomp" into "PC port" by YouTubers and subreddits.00801025 03E00008 10400003 27BD0018 8FB00010 0C0234B8 10400003 24844C10 8FBF0014 0C01A2F4 0C0234B8 00801025 27BD0018 00801025 27BDFFE8 3C048034 8FB00010 8FBF0014 00801025 27BDFFE8 3C048034 24844C10 27BD0018 8FB00010 00000000 0085102B 27BDFFE8 03E00008 10400003 0C01A2F4 8FBF0014 AFBF0014 8FBF0014 27BD0018 0C01A2F4 10400003 27BDFFE8 03E00008 24844C10 3C01800F 8FBF0014 10400003 0C0234B8 AFBF0014 0C01A2F4 3C01800F 03E00008 00801025 8FBF0014 27BDFFE8 3C048034 03E00008 27BD0018 3C048034 AFBF0014 8FBF0014 0C0234B8 0085102B 00801025 0C01A2F4 24844C10

With the right guidance, human input, and code reviews, AI can expedite the decompilation process in a significant way. What is also now clear is that the community aspect of decompilation has been broken.8FBF0014 AFBF0014 0C0234B8 00000000 24844C10 0C01A2F4 8FBF0014 03E00008 AFBF0014 3C01800F 27BD0018 00801025 0C01A2F4 0085102B 03E00008 0C0234B8 3C01800F 8FB00010 0085102B 0C01A2F4 27BD0018 AFBF0014 0C01A2F4 3C048034 8FBF0014 0C0234B8 03E00008

PhotoCraft

mimics Photoshop0C01A2F4 0C01A2F4 3C01800F 10400003 0C0234B8 0C01A2F4

VectorCraft

mimics Illustrator0085102B 0C01A2F4 00801025 00000000 24844C10 27BDFFE8

FilmCraft

mimics Premiere Pro0C01A2F4 24844C10 3C048034 10400003 00801025 24844C10

LightCraft

mimics LightroomAFBF0014 03E00008 AFBF0014 24844C10 0085102B 8FB00010

EffectCraft

mimics After Effects3C01800F 8FBF0014 10400003 8FBF0014 3C01800F 3C048034

DesignCraft

mimics InDesign3C048034 00000000 0085102B AFBF0014 27BDFFE8 00000000

PrintCraft

mimics Acrobat Pro. All seven: MIT or Apache, on Windows, macOS, Linux and WASM. ^{4 5}3C048034 27BD0018 27BDFFE8 AFBF0014 27BD0018 3C01800F 0085102B 00801025 27BDFFE8 0085102B 27BDFFE8 24844C10

Developer Brandon Thomas calls them "clean-room replacements." He claimed to have "one-shotted Photoshop. The whole thing," and promised feature parity "within a month," later softened to "months and not years." ⁴ His stated motive was Adobe's cancellation fees. Funding comes from selling token access to ArtCraft's own image and video models inside the apps. ⁴27BD0018 8FB00010 8FB00010 AFBF0014 AFBF0014 0C0234B8 27BD0018 AFB00010 3C01800F 8FBF0014 0085102B 0C0234B8 8FBF0014 0C0234B8 8FB00010 3C01800F 3C048034 3C048034 00000000 10400003 00801025 27BD0018 10400003 27BD0018 24844C10 8FBF0014 10400003 0085102B AFBF0014 0C01A2F4 10400003 8FB00010 3C01800F AFB00010 AFB00010 AFB00010 27BDFFE8 10400003 8FB00010 0C01A2F4 0085102B 00801025 03E00008 0C0234B8 AFBF0014 27BD0018 03E00008

The repository tells a calmer story. PhotoCraft was created on 30 September and two weeks later had about 54k stars and more than 800 open issues, with an "early alpha" badge. ⁵ Ars Technica describes the suite as "ambitious, free, and nowhere near finished." ⁴3C048034 00801025 3C01800F 27BD0018 0C01A2F4 0C01A2F4 AFBF0014 24844C10 27BDFFE8 0C01A2F4 0C01A2F4 3C048034 24844C10 3C01800F 03E00008 3C048034 8FB00010 0C0234B8 AFBF0014 00801025 27BD0018 27BDFFE8 00801025 3C01800F 3C01800F 27BDFFE8 10400003 0085102B 3C01800F 03E00008 10400003 0C0234B8 24844C10 10400003

Strictly speaking, none of this is decompilation. No Adobe code was published. It's behavioural reimplementation sped up by AI, and that's where the legal fight would be. A clean room traditionally means two teams with a wall between them. Critics point out that one developer and one model studying the original isn't obviously that. ⁴ Adobe's terms also restrict reverse engineering, including monitoring inputs and outputs to recreate the product. ²⁷ Trade dress, meaning a too-familiar look and feel, is a separate risk. ⁴ So far Adobe has said nothing publicly. ²⁸03E00008 24844C10 0085102B 27BDFFE8 27BDFFE8 10400003 3C01800F 8FBF0014 27BD0018 0C01A2F4 0C01A2F4 0085102B AFBF0014 8FB00010 3C01800F 10400003 0C01A2F4 03E00008 3C01800F 0C0234B8 8FBF0014 27BD0018 3C048034 AFBF0014 AFB00010 27BDFFE8 0085102B 8FB00010 00801025 27BD0018 AFBF0014 00801025 00000000 27BD0018 0C01A2F4 0C01A2F4 27BD0018 0C0234B8 00000000 AFBF0014 0C01A2F4 27BD0018 AFBF0014 27BDFFE8 00801025 03E00008 3C01800F 03E00008 27BDFFE8 0085102B 0C0234B8 10400003 8FBF0014 24844C10 0C0234B8 03E00008 10400003 8FB00010 AFB00010 27BDFFE8 0C01A2F4 AFBF0014 00801025 AFB00010 3C048034 03E00008 3C01800F 10400003 8FB00010 3C01800F 27BDFFE8 27BD0018 27BD0018 3C01800F

LLM clean-up of Ghidra output, a September 2026 study ⁹

• 75%
  compiles, Ghidra alone3C048034 27BD0018 00801025 0C01A2F4 03E00008 00801025
• 90%
  compiles, with the LLM0C0234B8 0085102B 27BDFFE8 8FBF0014 24844C10 00000000
• 74%
  behaves right, Ghidra alone8FB00010 3C048034 0085102B 03E00008 0C0234B8 00000000
• 62%
  behaves right, with the LLM0C01A2F4 8FB00010 10400003 3C048034 AFBF0014 AFB00010

More code compiles and less of it does what the original did. The study also found that up to about 10% of functions with known vulnerabilities stopped reproducing the bug: it disappeared without anyone asking. ⁵00801025 00000000 3C048034 AFBF0014 00801025 AFB00010 8FB00010 8FBF0014 0C0234B8 24844C10 27BDFFE8 3C01800F 27BDFFE8 AFB00010 AFBF0014 0085102B 27BDFFE8 10400003 AFB00010 27BD0018 0C0234B8 0C01A2F4 0C0234B8 3C01800F 8FB00010 24844C10 27BDFFE8 10400003

End-to-end neural decompilers

• 27%
  LLM4Decompile 1.3B3C048034 00000000 3C048034 00801025 3C048034 03E00008
• 45%
  LLM4Decompile 6.7B3C048034 00000000 3C048034 00801025 3C048034 03E00008
• 60 to 65%
  the best, on isolated functions3C048034 00801025 8FB00010 0085102B 00000000 AFB00010

Re-executability on HumanEval-Decompile. ⁷ Scores fall sharply at -O3, and simple obfuscation stopped both Ghidra and LLM4Decompile. ⁷ DecompileBench, with 23k real functions, found LLM decompilers more readable but with about half the functional correctness of commercial tools. ⁸27BDFFE8 03E00008 27BD0018 0085102B 27BD0018 3C048034 3C01800F 27BD0018 3C048034 24844C10 27BDFFE8 27BD0018 3C01800F 8FBF0014 00801025 3C01800F 0C0234B8 27BD0018 27BD0018 03E00008 03E00008 8FB00010 00000000 03E00008 0C01A2F4 24844C10 8FBF0014 27BDFFE8 8FB00010 3C01800F 27BD0018 00801025 10400003 24844C10 0C0234B8 AFBF0014 8FBF0014

How to reconcile this with the 84-day decomp. The benchmarks measure a model reading a binary and writing source in one pass. Game projects don't work that way. They keep the classic decompiler in the loop, run an agent through hundreds of attempts, and let a byte-exact comparison decide. The models aren't especially good decompilers. What changed is that someone built an automatic judge and gave them unlimited retries.24844C10 27BD0018 3C048034 AFBF0014 27BD0018 27BD0018 3C048034 00000000 24844C10 8FB00010 24844C10 27BD0018 8FB00010 00801025 27BD0018 10400003 00801025 24844C10 0C0234B8 00000000 0085102B 24844C10 8FBF0014 0C01A2F4 24844C10 27BD0018 8FB00010 10400003 8FBF0014 00801025 3C01800F 00000000 27BDFFE8 0085102B 8FB00010 27BD0018 00801025 3C01800F 0085102B 3C048034 3C01800F 00000000 00000000 0C01A2F4 3C048034 3C048034 0085102B 0085102B 00000000 27BD0018 03E00008 8FBF0014 8FBF0014 3C01800F AFBF0014

Where it doesn't carry over. Modern, heavily optimised, obfuscated or DRM-protected binaries that change weekly have no ground truth to compare against, and they're far too large to brute-force one function at a time. Security work is a middle case. One 2026 study cited by XHack found AI assistance saved 0.5 to 3 days per malware sample at equal or better accuracy. ³⁰27BD0018 0C0234B8 0C01A2F4 27BDFFE8 0C0234B8 00801025 00801025 3C01800F 8FB00010 24844C10 00000000 00801025 3C048034 8FB00010 3C048034 8FBF0014 24844C10 10400003 0C01A2F4 3C01800F 8FB00010 AFBF0014 AFBF0014 00000000 AFBF0014 8FB00010 00801025 8FB00010 AFB00010 3C01800F 00000000 0085102B 0C0234B8 27BD0018 0C0234B8 AFB00010 0C01A2F4 03E00008 3C01800F 0085102B 10400003 03E00008 8FBF0014 8FB00010 AFB00010 27BD0018 AFBF0014 0085102B

Gains

Preservation

Delisted, disc-only and server-dependent games can be kept playable and ported. This matters more now that Sony stops pressing PS5 discs in January 2028. ^{3 23}8FBF0014 8FB00010 0C01A2F4 8FBF0014 8FBF0014 03E00008 0085102B 00000000 8FBF0014 8FB00010 0085102B 27BDFFE8 3C01800F 27BD0018 3C048034 03E00008 3C01800F 24844C10 AFB00010 AFB00010 0C0234B8

Security research

Faster malware triage, and faster audits of firmware and closed binaries. ³⁰10400003 10400003 3C048034 3C01800F 00000000 AFB00010 8FBF0014 8FBF0014 27BDFFE8 0C01A2F4

Leverage against lock-in

Credible alternatives to software with hostile subscription terms are now cheap to start. ⁴3C048034 8FBF0014 10400003 0085102B 00801025 0C0234B8 AFBF0014 27BDFFE8 8FBF0014 0C01A2F4 24844C10 27BD0018

Understanding

Speedrunners can read the real CPU pathing and physics; modders can work from source instead of hex patches. ¹²03E00008 0C0234B8 AFBF0014 03E00008 AFB00010 0C01A2F4 00801025 0085102B 3C01800F 0C0234B8 27BDFFE8 27BDFFE8 00000000 24844C10 27BDFFE8

Costs

Cloning is cheap now

Any program you can get the binary for is under pressure. Indie developers are hit first and have the fewest lawyers. ^{2 4}10400003 0C0234B8 AFBF0014 0C01A2F4 10400003 00801025 27BD0018 27BD0018 10400003 24844C10 00000000 3C048034 27BDFFE8 8FB00010 10400003 AFBF0014

Community damage

Hostile forks, bounty-chasing and burned-out experts (see the PS5 part). ^{1 20}AFBF0014 10400003 00000000 00000000 0C0234B8 8FBF0014 8FBF0014 00000000 0C01A2F4 03E00008 0C01A2F4

Silent errors

LLM-polished code can look more plausible while behaving less faithfully. ⁹3C01800F 10400003 0C0234B8 24844C10 24844C10 3C01800F 27BDFFE8 AFB00010 27BD0018 00801025

Legal assumptions break

Copyright law assumed copying took skill and effort. ⁴03E00008 24844C10 8FB00010 00000000 00801025 3C048034 0085102B AFB00010

The legal map (US-centric)

Firmware timeline

1. 7.00 to 13.60
   Exploitable. Relapse gives kernel read and write in under a minute, on PS5 and PS5 Pro. ^{17 18}3C048034 03E00008 AFBF0014 8FB00010 00000000 24844C10 10400003 0085102B 8FB00010 0C0234B8 27BD0018 0085102B 8FBF0014
2. 13.60 and below
   Hypervisor. The Byepervisor Reborn bypass works on the same range. ¹⁹27BD0018 10400003 27BD0018 27BDFFE8 0C01A2F4 8FB00010 3C01800F 8FB00010 0C01A2F4 03E00008
3. 14.00, 16 Sep
   Patches both. New games start requiring it. ¹⁷3C01800F 0C01A2F4 03E00008 00000000 00000000 8FB00010 00801025
4. 14.10, 1 Oct
   More security fixes. Required for PSN. ¹⁹0C01A2F4 AFB00010 3C01800F 3C048034 27BD0018 10400003
5. 29 Sep
   Release. Relapse goes public; Wolverine and The Witcher 3 Remastered reported running. ¹⁷03E00008 8FBF0014 8FB00010 03E00008 0C0234B8 AFB00010 8FBF0014 8FBF0014 00000000 3C01800F 24844C10 0C0234B8

What a jailbroken PS5 can do. Homebrew, backups and piracy of anything that runs on 13.60 or lower, plus a Switch emulator running natively as PS5 homebrew. Kotaku also reports people booting physical PS3 discs on jailbroken units. ^{17 18} The catch is that it's offline only. Without 14.10 there's no PSN, and newer releases won't boot. ¹⁹27BD0018 27BDFFE8 3C048034 3C01800F 3C01800F 27BDFFE8 27BDFFE8 24844C10 00000000 3C048034 0C01A2F4 0C0234B8 00801025 AFB00010 8FB00010 8FB00010 27BDFFE8 0085102B 8FBF0014 03E00008 AFB00010 AFB00010 0C0234B8 8FB00010 03E00008 10400003 AFB00010 AFBF0014 0C0234B8 8FBF0014 3C048034 8FBF0014 27BDFFE8 0C01A2F4 27BD0018 AFBF0014 AFB00010 AFBF0014 00801025 00000000 10400003 8FB00010 AFBF0014 03E00008

The AI flashpoint. Andy Nguyen, the researcher behind the Vita's h-encore, quit the scene. He had deliberately kept the last known hypervisor bug unreported for a PS5 and PS5 Pro Linux release planned for 2027. Hunters he called "slop kiddies," who he says were using LLMs to write "hacks they don't even understand," found the same bug and reported it to Sony for the bounty. ²⁰3C01800F 10400003 0085102B 8FB00010 3C048034 27BD0018 00801025 03E00008 0C01A2F4 3C048034 00000000 0C0234B8 3C048034 10400003 27BD0018 0085102B 8FB00010 3C01800F 27BD0018 8FB00010 27BD0018 8FB00010 8FB00010 AFB00010 0C01A2F4 27BD0018 0C0234B8 AFBF0014 00801025 0C0234B8 00000000 0085102B 3C048034 8FBF0014 3C048034 8FB00010 8FBF0014 8FBF0014 24844C10 3C048034 00000000 3C048034 8FBF0014 24844C10 27BDFFE8 AFBF0014 0C01A2F4 3C01800F AFB00010

Why it's moving faster than PS3 emulation did. The PS5 is close to a PC (a Zen 2 CPU, an RDNA2-derived GPU), so the work is mostly translating system calls and shaders rather than emulating exotic hardware like the PS3's Cell. That's where agents help most. ^{5 23} Sony hasn't moved against the emulators (Connectix is a case it lost); its real leverage would be §1201 claims over keys and DRM. ^{21 24}27BD0018 27BD0018 10400003 3C01800F 00801025 03E00008 3C048034 AFB00010 27BDFFE8 AFB00010 03E00008 8FBF0014 00801025 AFB00010 0C01A2F4 0C0234B8 3C01800F 0C0234B8 0085102B 00801025 00000000 03E00008 27BDFFE8 00801025 27BDFFE8 AFB00010 8FB00010 0085102B AFB00010 27BD0018 AFBF0014 0085102B 27BDFFE8 10400003 27BD0018 00000000 27BDFFE8 00801025 03E00008 00000000 0C01A2F4 AFB00010 0C01A2F4 0C01A2F4 00801025 3C048034 0C01A2F4 27BDFFE8 8FBF0014 8FBF0014 8FBF0014 0C01A2F4

PS5 games on PC

The machine: Windows 11, an RTX 5090 with 32 GB, 63 GB of RAM, and WSL2 Ubuntu 24.04 with gcc 13.3.0, the MIPS binutils and clang. The local model was Qwen3.8-27B at UD-Q4_K_M under a llama.cpp router, served through Hermes Agent. The frontier models were Claude Haiku 5.5 and Claude Sonnet 5.5 over the API at default sampling. An agent built the harness and ran every test; the judge was checked first by feeding it the original sources, which pass 656 of 656. ³³0C01A2F4 0085102B 24844C10 3C048034 0085102B 8FB00010 0085102B 00801025 0C01A2F4 8FB00010 10400003 24844C10 0085102B 00000000 0085102B 8FB00010 8FBF0014 00000000 00801025 00000000 3C048034 3C01800F 00801025 24844C10 0C0234B8 03E00008 AFB00010 3C048034 0085102B 10400003 00000000 8FB00010 10400003 0C01A2F4 00801025 10400003 0C0234B8 24844C10 0085102B AFB00010 AFBF0014 0C0234B8 10400003 24844C10 8FB00010 00000000 0085102B 3C048034 10400003 8FB00010 03E00008 27BDFFE8 03E00008 3C01800F 00801025 00801025 3C01800F 0C0234B8 27BD0018 0085102B

Test 1: one pass, x86-64

HumanEval-Decompile, the LLM4Decompile legacy set: 164 problems compiled at -O0 to -O3, 656 functions. ³³ The model gets the objdump of one function and writes C. A pass compiles with the original test harness and runs to exit 0 within five seconds, the upstream rule. The Claude models saw a seeded sample of 48 items, twelve per level, with an 8,192-token output cap. Qwen was pointed at all 656 and stopped at 243 when the test ended.27BD0018 3C01800F 8FBF0014 8FBF0014 0C01A2F4 8FB00010 AFB00010 27BDFFE8 27BD0018 10400003 03E00008 0C01A2F4 10400003 0C01A2F4 00000000 03E00008 0085102B 10400003 8FB00010 00000000 3C01800F 00000000 3C01800F 8FBF0014 0085102B 0C01A2F4 24844C10 3C01800F 0085102B AFBF0014 24844C10 AFBF0014 00000000 AFBF0014 AFB00010 0C0234B8 8FB00010 27BDFFE8 3C01800F 00000000 8FBF0014 0085102B 0C01A2F4 27BD0018 0C01A2F4 AFB00010 3C048034 03E00008 8FBF0014 AFB00010 8FB00010 00801025 00801025 8FB00010 8FB00010 0C01A2F4 0C0234B8

Haiku passed 41 of 48 and Sonnet 38 of 48. Qwen passed 179 of 243, about ten seconds a function with four requests in parallel and the GPU at about 30 of its 32 GB. The item sets differ, so the honest reading is overlapping intervals, not a ranking: on the 23 items all three saw, the counts are 21, 20 and 19. Every model is nearly perfect at -O0 and drops at -O3, where Haiku landed 7 of 12 and Sonnet 6 of 12. The published LLM4Decompile numbers, 64.9% for the 9B model and 63.6% for the 22B, were not run here. ³² The set has been public since 2024, so contamination may lift everyone.00000000 0085102B 3C048034 8FBF0014 00801025 27BD0018 27BD0018 10400003 27BD0018 00000000 3C01800F 00801025 27BD0018 0C01A2F4 0C0234B8 03E00008 3C01800F AFB00010 00000000 8FB00010 8FBF0014 0C01A2F4 03E00008 AFBF0014 3C048034 10400003 8FB00010 8FB00010 0C0234B8 00801025 0085102B 27BDFFE8 AFBF0014 24844C10 0C01A2F4 00801025 0C0234B8 10400003 0C01A2F4 0085102B AFBF0014 27BDFFE8 03E00008 0C01A2F4 03E00008 8FBF0014 8FB00010 AFBF0014 0C01A2F4 03E00008 0085102B 24844C10 10400003 03E00008 10400003 00000000 03E00008 AFB00010 00801025 0C0234B8 03E00008 0C01A2F4 27BD0018 27BDFFE8 8FBF0014 3C01800F 27BDFFE8 0C0234B8 8FBF0014 8FBF0014 0085102B 3C048034 0C01A2F4 3C048034 AFBF0014 00000000

Sonnet returned five refusals, the API's stop_reason: refusal, with no output, and the same five on a re-run. One of them is an array Fibonacci. Haiku solved four of the five and Qwen solved the Fibonacci. Counting only what it answered, Sonnet is at 38 of 43, but a fallback model that returns nothing one call in ten costs more than a few points of accuracy. The dominant failure for every model is code that compiles and then behaves wrongly: 55 of Qwen's 64 misses compiled cleanly.0C01A2F4 10400003 03E00008 03E00008 27BD0018 10400003 27BDFFE8 10400003 8FBF0014 00801025 03E00008 00801025 00801025 0C0234B8 00000000 00000000 0C01A2F4 0C0234B8 24844C10 0085102B 0C0234B8 10400003 8FBF0014 AFB00010 0085102B 0C0234B8 3C01800F 27BD0018 03E00008 0C01A2F4 0C01A2F4 8FB00010 00000000 AFBF0014 3C01800F 03E00008 3C048034 8FB00010 8FBF0014 3C01800F 8FBF0014 27BD0018 AFB00010 3C048034 0085102B 8FBF0014 0085102B 10400003 8FB00010 0085102B 0C0234B8 10400003 27BD0018 3C048034 0C01A2F4 3C01800F 00000000 3C01800F AFBF0014 8FBF0014 8FB00010 AFB00010 8FB00010

Test 3: a real N64 game, in the loop

Snowboard Kids 2, from an owned cartridge whose dump matched the project's SHA-1, rebuilt byte for byte with make before anything else ran. ¹⁰ A selection script took already-matched functions between 8 and 300 instructions, rebuilt each one's workspace with the project's own tools, removed every function body from the source file the model would see, and kept a function only if the original source still scored 100% in that isolated workspace. Thirty survived, ten per size. Haiku then ran the loop on the first two of each size, six attempts at most: target assembly plus the m2c draft in, C out, compiled by the project's KMC GCC 2.7.2 at -O2, with compiler errors or an asm-differ score and diff fed back.3C048034 00000000 8FB00010 3C01800F 03E00008 8FBF0014 27BDFFE8 03E00008 8FBF0014 3C048034 10400003 0C0234B8 8FBF0014 0C0234B8 00000000 10400003 8FBF0014 8FB00010 8FBF0014 10400003 27BD0018 00000000 0C0234B8 8FBF0014 03E00008 00801025 10400003 3C048034 27BD0018 8FBF0014 8FB00010 0085102B 3C048034 00000000 10400003 10400003 10400003 00801025 AFB00010 3C01800F 3C01800F 24844C10 27BDFFE8 0C01A2F4 3C01800F 00000000 3C048034 8FBF0014 24844C10 8FB00010 8FBF0014 8FBF0014 10400003 3C01800F 8FBF0014 27BDFFE8 3C048034 3C048034 AFBF0014 03E00008 3C048034 27BDFFE8 0C01A2F4 AFB00010 27BDFFE8 0085102B 27BD0018 3C048034 0085102B 3C048034 03E00008 8FBF0014 27BD0018 0085102B 27BD0018 8FB00010 10400003 0085102B 8FBF0014 8FBF0014 24844C10 AFBF0014 8FBF0014 AFBF0014 8FBF0014 0C0234B8 8FBF0014 03E00008 27BDFFE8 24844C10 3C01800F 3C01800F

Two of six matched: a 16-instruction function on its first attempt and a 71-instruction one on its sixth. A third reached 98.7% on attempt three and never got back there, because the harness fed the model its latest attempt rather than its best, and the model's own next edit threw the near-match away. The project's own rule gives up only after 40 attempts without improvement, not six. ¹⁰ The six functions cost 493,425 input tokens and 85,554 output tokens; six of the 31 attempts did not compile and one returned no code. Of the 36 functions eligible for the test, the free m2c draft alone matched 6, compiled but mismatched 9, and did not compile at all for 21.0C01A2F4 AFB00010 3C01800F 27BD0018 10400003 AFB00010 27BDFFE8 AFBF0014 00801025 0C01A2F4 0085102B 00000000 10400003 27BD0018 27BD0018 0C0234B8 8FBF0014 0C0234B8 3C048034 24844C10 AFBF0014 0085102B 03E00008 00801025 00000000 AFBF0014 00801025 10400003 00801025 10400003 3C048034 10400003 27BDFFE8 AFB00010 3C048034 24844C10 AFB00010 0C01A2F4 0085102B 3C048034 8FBF0014 AFBF0014 10400003 27BD0018 3C01800F 0C0234B8 00000000 3C01800F 00801025 AFBF0014 3C048034 10400003 24844C10 3C048034 00000000 03E00008 8FBF0014 8FBF0014 00000000 0C01A2F4 10400003 27BD0018 0085102B 0C01A2F4 3C048034 00801025 0C01A2F4 AFBF0014 00000000 00000000 AFB00010 3C048034 27BDFFE8 00000000 0C0234B8 10400003 00000000 3C048034 8FB00010 AFBF0014 8FB00010 10400003 10400003 27BD0018 0C01A2F4 24844C10

Cost, and what was not run

The whole experiment billed about 38 cents of Claude at the prices published on 18 October: four cents for Haiku on Test 1, nine for Haiku in the loop, 25 for Sonnet on Test 1. ³⁹ The local run's electricity was not metered. Not run, because the test was stopped: the local model inside the Test 3 loop, which was the headline question; Sonnet in that loop; the other 24 selected functions; a second test on the cJSON library ³⁴; and the LLM4Decompile 9B and 22B models locally, downloaded and never started. ³² Everything about whole-game time and money stays an estimate until the local model has been in the loop.27BDFFE8 0C0234B8 3C048034 24844C10 8FB00010 0085102B 10400003 10400003 3C01800F 27BDFFE8 8FBF0014 AFB00010 00801025 8FB00010 8FB00010 27BD0018 AFBF0014 10400003 3C01800F 0C01A2F4 00801025 3C048034 3C01800F 00801025 8FB00010 27BDFFE8 AFB00010 3C048034 03E00008 3C01800F 3C048034 27BD0018 00000000 24844C10 03E00008 27BDFFE8 0C01A2F4 3C048034 03E00008 8FBF0014 00000000 24844C10 8FB00010 00801025 24844C10 00000000 3C01800F 0C01A2F4 27BD0018 00000000 AFBF0014 AFBF0014 3C048034 0C01A2F4 00801025 8FB00010 24844C10 27BDFFE8 8FB00010 8FB00010 27BD0018 03E00008 27BDFFE8 0C0234B8 0C0234B8 0C01A2F4 00000000 00000000 AFB00010 AFB00010 00000000 00801025 8FBF0014 0C0234B8 8FBF0014 00801025 27BD0018 3C01800F AFBF0014 3C01800F