ps5debug-NG v1.3.2

ps5debug-NG v1.3.2

v1.3.0 was the big feature release. v1.3.2 is the correctness and reliability release that follows it: writes now prove they landed, three separate session-killing bugs are fixed, a scan comparator that silently returned wrong results is repaired, and firmware support extends through FW 13.60.

There was no separate v1.3.1 download, so this release also contains everything from v1.3.1 (Turbo Scan cancel).

---

⚠️ Read this first: writes are now verified, and that changes what you see

Process writes used to report success as soon as the write was handed off. They are now read back and compared before success is reported, so a write that silently did nothing now correctly reports a failure.

If you are a client developer: a write that previously appeared to succeed may now return CMD_ERROR. That is the bug surfacing, not a new bug. Servers advertise capability level 1.1 so clients can detect the behaviour.

• CMD_PROC_WRITE returns terminal CMD_ERROR on write or verification failure.
• Write-multi returns typed per-entry status codes (invalid / DMAP / verify / mdbg) so you can tell exactly which entries failed and why, instead of losing the detail in one aggregate result.
• A proven DMAP mismatch no longer quietly falls through to the mdbg path.
• Caveat: a transfer whose start address ends in 0xFF backs up one byte to keep the write aligned. That adjacent-byte read-modify-write is not atomic, so it needs a stable or suspended target to be safe.

---

🛠️ Session-killing bugs fixed

• Fixed a debug session wedge that required a console reboot. Toggling a trainer patch while the target was stopped at a breakpoint could deadlock the sole debug worker: an RPC stop was issued against a process the debugger already held ptrace-stopped, so the wait never returned, the worker died, and every reattach afterwards failed (clients reported "Process not connected" / already-debugging) until the console was restarted.
• Fixed a crash when allocating memory on games with tight executable memory. The allocation arena reserved a full 16 MB RWX segment up front; on a game whose executable pool ceiling is only ~2 MB that reservation fails and attach-time allocation threw. The arena now grows on demand - the first segment is exactly the size requested, then segments grow geometrically up to the cap, so heavy clients still amortise while tight games work. Hardware-validated on FW 9.00.
• Hardened software breakpoints against 0xCC corruption. Re-arming the same slot at the same address is now idempotent, so the already-patched 0xCC can never be saved as the restore byte (which previously could leave a permanent 0xCC in the target). Arming at address 0 is rejected, moving an enabled slot requires an explicit disarm, and only one INT3 owner per address is allowed across slots.
• Watchpoints no longer lose which one fired. The event dispatcher's own debug-register accesses were clearing the live DR6 before the client saw it. The event DR6 is now snapshotted and re-applied to the outgoing packet.
• Stale state can no longer leak into a reattach. Every breakpoint slot and the watchpoint/debug-register shadow are cleared on all teardown paths, including the dead-target exit, so a reconnecting client cannot inherit the previous session's slots.
• ELF injection scratch mappings now use RWX protection.

---

🔎 Scanning

• Fixed "increased by" / "decreased by" silently behaving like "unchanged". Both comparators read the 8-byte double delta as a 4-byte float, so round values such as 1.0 - whose low 32 bits are all zero - collapsed to 0.0. This affected Turbo Scan and the legacy, regular and async scan/rescan paths. The wire format was always correct, so no client change is needed.
• Turbo Scan cancel - abort an in-flight scan for a pid instead of waiting it out. Sent from a second connection, since the scanning connection is busy streaming; all parallel workers observe the flag and stop early. A cancelled snapshot frees the half-built snapshot and reports failure; cancelled known-value scans return partial results and the session should be ended or restarted before being trusted.
• Compact Simple float snapshots - a float/double snapshot using the Simple policy now filters values before storage and keeps only address-sorted survivor records, instead of allocating dense per-slot stores for the entire scanned range first. Large unknown-initial float scans no longer spill or fail at raw-slot scale when only a small survivor set will remain. Negotiated separately from the float policy itself, and clients that do not understand it transparently fall back to streaming.

---

🎮 Firmware support: now through FW 13.60

• Added FW 13.40, 13.42 and 13.60. The full recognised list is now 3.xx through 13.60.
• 13.60 needed its own handling: its kernel data layout shifted relative to 13.0x-13.4x, so a shared code path would have written the kernel patch to the wrong address.
• Offsets were derived from decrypted kernel dumps by static analysis, cross-checked against a known-good firmware as a control, and then confirmed on real hardware.
• Purely additive and firmware-gated - every previously supported firmware is untouched.

---

🧰 Build and provenance

• Branding now carries a 16-hex build fingerprint, so a staged or shared payload can be identified from CMD_BRANDING instead of guessing which build someone is running.
• build.sh now guards the release build environment, so an official build cannot silently be produced on the wrong toolchain.
• Added a header that was left untracked when the write path was committed - a fresh clone previously did not build.

---

📖 Documentation

• PROTOCOL.md and README updated for the verified-write semantics, the per-entry write-multi status codes, the 0xFF adjacent-byte behaviour, the Turbo Scan cancel opcode, compact Simple snapshots, and the v1.3.2 / capability 1.1 / build-fingerprint branding.
• README firmware table extended through 13.60.

---

⚠️ Known caveats

• The 0xFF-address adjacent-byte read-modify-write described above is not atomic - use it against a stable or suspended target.
• A cancelled Turbo Scan leaves a known-value session indeterminate; end or restart it before trusting results.
• AVX-512 (ZMM / opmask) is still unsupported - the PS5 CPU (Zen 2) has no AVX-512, so YMM0-15 remains the complete vector set.
• Client UI for the per-entry write status codes and for cancel depends on each client; this release provides the server-side support they build on.

---

💜 Credits

• @Pharaoh2k - content-verified writes and capability 1.1, the RPC-deadlock and arena crash fixes, breakpoint/watchpoint hardening, the double-delta comparator fix, Turbo Scan cancel, compact Simple float snapshots, FW 13.40/13.42/13.60 support, build provenance and the documentation pass.