Vampire Survivors (PPSA21703) on Windows with NVIDIA: stops when the PSN plugin starts without its start argument

[THEMANnt]

Tested Title: Vampire Survivors, PPSA21703, content version v01.016.107. Unity, IL2CPP, FMOD (judging by the module and thread names in the log).

Host: Windows 11 Pro 10.0.26200, AMD Ryzen 7 7800X3D, NVIDIA GeForce RTX 5070 Ti (driver 616.92; an AMD integrated GPU is also present, the NVIDIA card is selected), WinLibs GCC 15.3.0 (the docs pin 15.2.0), Release.

AnyPS5 main at a11c8f7. The runtime's libs match the build: after building the libs target, every .prx in the runtime was compared by hash.

Relinked with --windows --windows-diagnostics --module-dir Media/Modules --module-dir Media/Plugins (no --to-intel), from a staging folder holding plain ELFs for eboot, sce_module, Media/Modules and Media/Plugins.

How far it gets

• All modules load, including PS5Util, Il2cppUserAssemblies and the four plugins (CommonDialog, PSN, SaveData, lib_burst_generated).
• Unity boots: it reads boot.config, global-metadata.dat, globalgamemanagers, level0 and the resources, and creates the Vulkan device and a swapchain on the RTX 5070 Ti.
• Then the PSN plugin stops it:

ERROR...
 PSN is an old version that cannot be used by the current player runtime.
 Please update the PSN native module and any associated managed assemblies to the latest versions

FATAL: unhandled exception 0xc0000005 on thread 47284 ''
  rip 0x00007ffa95113ed7 PSN.prx.guest.prx+0x13ed7
  read of 0x0000000000000004

Analysis
As described for Silksong in #726, the Media/Plugins modules are started with sceKernelLoadStartModule(path, 16, {16, 0x200, ...}), and the PSN entry refuses with this message when the argument is missing. The read at address 4 fits a field read through a null pointer. The faulting call comes from the game's managed code through libkernel (frames libkernel.prx+0x485ae and +0x45f2b, then Il2cppUserAssemblies). I have not traced how this title starts the module.

Expected: the plugin receives its start argument and the title continues, as Silksong does on current main with #846.

Related: #726, #846. Log attached (run.log, all-threads dump trimmed).

AI-assisted: yes (the write-up was drafted with an AI assistant; the runs and results are mine).
run.log

[JAB-dev]

I will post args and prs tomorrow but here is teaser of one of the bugs fixed while I'm still self reviewing the prs

chest_before_after_169.mp4

[Nesyth]

Same title on Windows with an AMD GPU, for comparison: here it gets past the PSN plugin and is playable at 60 FPS.

Tested title: Vampire Survivors, PPSA21703, v01.016.107.
Host: Windows 11 Pro 10.0.22631, AMD Ryzen 7 7800X3D, AMD Radeon RX 7900 XTX, WinLibs GCC 15.2.0, Release.
AnyPS5: main at 1770f35 plus the fixes below. Relinked with --windows --registry --module-dir Media/Plugins --module-dir Media/Modules.

What works: boot, menus, saving and loading, full runs with level-ups and chests, the results screen.

Problems found on the way, and their fixes:

• Crash when pressing "Done" on the results screen: the driver refused a DCC decompress pass because DB_DEPTH_CONTROL was left set, although no depth or stencil plane was bound. fix(agc): accept a CB metadata pass beside depth state without depth or stencil planes #4076
• Shadow on the health bar: Unity pads its UI vertex to 32 bytes and vertex copies ended mid-record, so Vulkan's robust buffer access returned zeros for the bar's last vertex.
• Blocky white overlay that stays after a 5-item chest: the UI layer is cleared with comp-to-single DCC keys (0x10), which only a DCC decompress pass expanded, so sampled reads kept the old texels.
• Random crash while loading (about half the launches): the title calls sceKernelClose(0) many times, and libkernel passed it to the host, which closed descriptors that later host file opens had reused. An issue with the log will follow.
• Laggy music with pops: AudioOut returned in SDL's consumption bursts instead of the console's steady grain cadence, so FMOD's ring replayed blocks.

Still open: one "marker stack underflow" abort right after the results screen, not reproduced since.

vampire_10mb.mp4

[THEMANnt]

Update: I can now reach gameplay on Windows with an NVIDIA GPU. My local build included several changes, so I can’t attribute the result to one fix. PR #4413 contains the APR read change and regression test. I also used a local workaround for PSN.prx/SaveData.prx when they’re launched with zero arguments and a null argument pointer; that workaround isn’t in the PR. I’ll update this discussion if I isolate a general fix for the missing start argument.

[JAB-dev]

Same title on Windows with NVIDIA, as a second report.

• Content version tested: 01.016.107
• AnyPS5 commit: the clip below is main at a11c8f7 (Oct 11) with the draw pipeline pull request merged on top (28 conflicts resolved by hand) plus local versions of the fixes in the table; the loading and "Done" checks were also run on main at 2a5eca1 plus the descriptor-close pull request alone
• System tested: Windows 11 Pro 10.0.26100, Ryzen 5 5600XT, RTX 4070 SUPER (NVIDIA 610.88), WinLibs GCC 15.2.0 r7
• Furthest point: In game
• What is shown: boots, menus, runs and level-ups play with picture and audio. 48 to 58 FPS in the clip below (26-minute run, level 89, draw pipeline pull requests applied); stock main was about 25-28 FPS in heavy scenes.

How I relinked (current main, WinLibs GCC 15.2.0, plain ELFs straight from the dump, run from an empty game folder):

relinker.exe --windows --windows-diagnostics --registry --module-dir Media/Modules --module-dir Media/Plugins <dump>\eboot.bin app.exe

Then copy the dump's Media and sce_sys into app0, and the relinker's *.guest.prx outputs next to their originals (app0/Media/Plugins, app0/sce_module). With that layout the PSN plugin starts normally here (PSN Initialized), so I don't think main is missing its start argument. The relative path under --module-dir is what matters.

Current blocker, and the pull requests involved

Problem	PR	State
Menus and level-ups at 25-28 FPS	#1193, #1201, #1202	open drafts; merged onto main a11c8f7 for the clip, they conflict with current main
Crash while loading: an APR read failed with CRT errno 9. It looks like the host stdin closing from sceKernelClose(0)	#3295 (keep host standard streams open on guest close)	open, loading and the "Done" button work with it on this title, with none of my workarounds
"Done" on the results screen: DCC decompress pass refused with DB_DEPTH_CONTROL left set (non-indexed rect list, 4 vertices)	#4076	merged
Packed R11G11B10 float fast clears not encoded	#4315	open
Legendary chest: gray blocks and a dot grid over the screen, from comp-to-single DCC keys (0x10) on a sampled texture	#4700	open draft

Clip below: 30 seconds of that run, window only, frame counter visible.

vs_pipeline_30s.mp4