Ratchet & Clank: Rift Apart (PPSA01474) on Linux

[EdouardSence]

Tested

• Title: Ratchet & Clank: Rift Apart, PPSA01474, v01.003.001, dumped from the contributor's own console. The fake-signed SELF containers have plaintext segments and were unwrapped to plain ELF before relinking, with no decryption:
  • eboot.bin;
  • sce_module/{libc,libSceJobManager,libSceNpCppWebApi}.prx;
  • the title's own modules at the root of the app (libcohtml.Prospero, libChakraCore, libRenoirCore.PS5, HttpServer.Prospero), relinked from prx/.
• Host: CachyOS (Linux 7.2.9), Ryzen 7 7800X3D, RX 9070 XT (RDNA4), RADV / Mesa 26.2.4. Runs are headless in gamescope with scripted input.
• Build: Release, GCC, main 43972e6.
• Last update: 2026-10-09.

Status

Not in game. No frame has been presented yet.

Stack (on main)	Where it stops
main	Doesn't load: libChakraCore.prx.guest.prx: undefined symbol: mTBZfEal2Bw (mlock); munlock (OG4RsDwLguo) is missing too
+ #1673 + a throwing placeholder for munlock	about 9 s: sceVideoOutUnknown00 not implemented (kP2L8t3j-aM)
+ #1339 + #1836 + #1837	about 19 s: SIGSEGV in title code

Current stop

• The crash is on the main thread, in title code, at cmpq $0x0,(%rbx) with rbx = 0.
• The function before it calls what looks like an allocator, (allocator = arg3, size, name, 16), with a null allocator. So a pointer the title expected to be set up earlier is null.
• The last library log line before the crash is [libSceSysmodule] sceSysmoduleLoadModule unknown id: 267. 267 (0x10b) is not in ModuleTable.hpp, and the call returns success without loading anything. I haven't confirmed that the two are related.
• 16 shaders are deferred by fix(agc): defer shaders that cannot be prepared at registration to their first use #1836 because their program address registers are missing from the header.

Tested and written by Claude (AI assistant) on a contributor's machine.

[EdouardSence]

Update: the 19 s crash is a pthread layout problem. #2184 fixes it.

• The title reads its thread id as the first 32 bits of the object pthread_self() returns, as in FreeBSD's struct pthread { long tid; ... }.
• On Linux the adopted main thread's PthreadPrivate started with an empty std::thread, so the title read 0. It then picked an empty slot in its per-thread allocator table, which gave the null allocator. The sceSysmoduleLoadModule unknown id: 267 line was unrelated.

With #2184 on top of the stack above (plus #1893 and #2105), the title registers its shaders and reaches its first draws. It then stops about 19 s in on:

AGC graphics: PA_SC_CONSERVATIVE_RASTERIZATION_CNTL=0xe6000: only 0x6000 (off) and 0x6001 (overestimation) are supported

Tested and written by Claude (AI assistant) on a contributor's machine.

[EdouardSence]

Update: the run now goes to about 25 s and about 625 prepared shaders. Each step below gets past the stop before it:

Added	Stop after it
#2184 (pthread tid)	PA_SC_CONSERVATIVE_RASTERIZATION_CNTL=0xe6000
#2226 (on #1915)	DB_RENDER_CONTROL depth clear draw (0x1)
#2219	null pixel program static ABI miss
#1902	prepared rectangle artifacts are missing
#1928	color views of several array slices are unsupported (#2102)

#1077 would be the next candidate, but it no longer merges into main. No frame has been presented yet.

Tested and written by Claude (AI assistant) on a contributor's machine.

[EdouardSence]

Update: first frames presented.

Stack: main 43972e6 + #1673 (now with munlock), #1339, #1836, #1837, #1893, #2105, #2184, #2226 (on #1915), #2219, #1902, #1928, #759, #1940, #2133 and CouchRiv's #1789 branch (bd5f22c). There are no local placeholders left: every import resolves.

• Last step: with feat(agc): implement deferred faults for reads through null SRT pointers #759, fix(shader): decode the scalar aperture sources 235-238 instead of failing the shader #1940, fix(shader): bind 2D textures to 3D sample and load accesses as measured #2133 and bd5f22c added, the color views of several array slices stop (Layered rendering: a draw into all slices of a 3D color target aborts with "color views of several array slices are unsupported" #2102) no longer shows up in a 6-minute run.
• What renders:
  • The title presents frames at about 33 per second for the whole 6 minutes.
  • The first dumped frames are correct: a splash with Ratchet's face, then the PlayStation Studios logo fading out.
  • After that the output stays black for the rest of the run. The game keeps dispatching and drawing, and nothing throws.
  • I haven't found out yet whether the black is loading, an intro movie that isn't decoded (it opens /app0/d/movie*), or a rendering problem.
• Setup: Linux, RX 9070 XT (RADV), headless gamescope with scripted input. Frames were dumped every 300 presents.

Tested and written by Claude (AI assistant) on a contributor's machine.