Onimusha: Way of the Sword (PPSA27836)

[simonbronk]

Current status (2026-10-14)

Content version tested: 01.000.001 (base game, no patch), dumped from the user's own console. eboot.bin and sce_module/libc.prx unwrapped with #5588's tools/unwrap_self.py.

AnyPS5 commit: main 0b97f8b plus the pull requests below.

System tested: Windows 11 Pro (26200), AMD Ryzen 7 9800X3D, NVIDIA GeForce RTX 5070 (driver 617.42), 31 GB of RAM, WinLibs GCC 15.2.0 r7, Release.

Furthest point: shader preparation at boot, before the first frame; the window stays black.

Start-up stops, in order

1. NULL write at the entry point (Onimusha WotS (PPSA27836) crashes at ELF entry point with NULL write (GDB backtrace attached) #5622, app.exe+0xcc9fb after two sceKernelDebugRaiseException calls): the title's malloc returns NULL with the image above 1 TiB, as in PRAGMATA (PPSA02530 v01.200.000) on Windows: the title's libc rejects its allocator's mspace buffer in the ASLR-relocated image above 1 TiB, so the first malloc returns NULL and start-up faults #3043. Relinking with --windows-fixed-base 0x400000000, as oneandonlydean suggested in Onimusha WotS (PPSA27836) crashes at ELF entry point with NULL write (GDB backtrace attached) #5622, passes it. No code change.
2. Missing export -MU9L6S3Fj4 (sceHttp2WebSocketSetPingTimeout) in libSceHttp2.prx, reported by tools/import_audit.py: the loader stops. feat(libSceHttp2): export sceHttp2WebSocketSetPingTimeout #5771 exports it as a throwing stub; it is not called during start-up.
3. Unsupported memory protection bits: -14: the title maps direct memory with prot=0xf2 and then calls sceKernelMprotect with 0xfffffff2 on the same range (APS5_TRACE_MEMORY=1):

   [memory] map direct 000000e800a00000+0x10000 phys=0x327f0000 prot=0xf2 flags=0x10 align=0x0
   [memory] protect 000000e800a00000+0x10000 prot=0xfffffff2
   

   fix(libkernel): drop undefined protection bits in sceKernelMprotect #5770 drops the undefined bits, as FreeBSD 11's sys_mprotect does.
4. sceConvertKeycodeGetCharacter: unsupported state 67108864: the same 0x4000000 that PRAGMATA passes (PRAGMATA (PPSA02530) calls sceConvertKeycodeGetCharacter with a second argument of 0x4000000, which throws "unsupported state 67108864" (follow-up to #5366) #5726). The title passes it as a constant while it builds a table of key names for keycodes 0 to 0x8F, and expects unshifted characters. fix(libSceConvertKeycode): ignore the state bit 0x4000000 RE Engine titles pass #5776 ignores that bit.
5. fix(shader): capture image descriptors read from constant buffers at uniform offsets #5188's stop: GetImageResource dword 0 is not a valid runtime value; chain: ReadConstBuffer@pc=0x0000297c(...), the same message as Resident Evil Village's mesh program (Resident Evil Village (PPSA01556) #5169). fix(shader): capture image descriptors read from constant buffers at uniform offsets #5188 passes it.
6. Per-lane material T#s: pixel programs read their T# from 48-byte records at +16 (key * 0x30), the key loaded through a readfirstlane inside a bit-mask loop; one program uses the same table T# for two image operations. fix(agc): accept bindless image tables with entries wider than 32 bytes #5620 (records wider than 32 bytes) and fix(shader): plan a table T# that several image operations share #5550 (a table T# shared by several image operations) pass these, both merged.
7. static bindless image capacity exceeded, the same as PRAGMATA (PRAGMATA (PPSA02530): a shader with four bindless image tables and five direct images exceeds MaxImages 64 ("static bindless image capacity exceeded") #5720): a program needs more image slots than MaxImages (64) with 16 slots per table. feat(recompiler): bindless image tables up to the device's sampled-image limit #1184 targets this limit but is parked for a redesign. Raising MaxImages and SampledHeapCapacity to 128 locally (not proposed) passes it.
8. bindless image table has 32768 entries (0 materials), limit 16: a compute program keys its table through a material record read at readfirstlane(i) << 6 and masked with 0x7fff. feat(shader): enumerate bindless material keys behind a mask or a shifted selector #5820 enumerates such keys.
9. 1D T# sampled through a 2D-array image_sample_l: measured on gfx1036 (the 2D-array sample reads as DIM 1D); fix(shader): read explicit-LOD and level-zero 2D-array samples through 1D T#s as measured #5841 gives it the 1D mode.
10. [videoout] presentation failed: bindless image table has 32768 entries (0 materials): the title reaches its first presentation. A draw reads a T# from the 48-byte table at a key the SRT walk can evaluate, which fix(agc): accept bindless image tables with entries wider than 32 bytes #5620 plans as a bindless table; the fix suggested on fix(agc): accept bindless image tables with entries wider than 32 bytes #5620 passes it. Some material buffers then hold 512 records, above APS5_BINDLESS_MATERIAL_SCAN's default of 256; with it set to 65536 the tables resolve (mode M, 1 keys).
11. Current blocker: AGC graphics: nonstandard sample locations varying between pixels are unsupported, the checkerboard rendering Resident Evil Village (PPSA01556) #5169 also approximates locally. No open pull request.

About 100 shaders log could not be prepared at registration (its s_swappc_b64 at program counter 0x74 calls a computed target) before the stop.

Pull requests

PR	Fixes
#5771	Stop 2: the missing sceHttp2WebSocketSetPingTimeout export
#5770	Stop 3: sceKernelMprotect with undefined protection bits
#5776	Stop 4: sceConvertKeycodeGetCharacter state 0x4000000
#5188	Stop 5: image descriptors read from constant buffers at uniform offsets
#5841	Stop 9: 1D T#s sampled through 2D-array explicit-LOD and level-zero samples (measured)
#5820	Stop 8: material keys behind a mask or a shifted selector
#5620, #5550	Stop 6: table T#s in 48-byte records, and a table T# shared by two image operations
#5588	Unwrapping the dump's SELF containers (tool only)

Also merged on the local branch, with no stop of this title shown to depend on them: #5189, #5703, #5688, #4883, #5181, #5089 (from the Resident Evil Village list in #5169). #3965 conflicts with main in a relinker test and was left out.

Local changes not proposed

• MaxImages and SampledHeapCapacity raised to 128 (stop 7).
• TryMakeTableImage leaves T#s with an evaluable key to GetHandle (stop 10, suggested on fix(agc): accept bindless image tables with entries wider than 32 bytes #5620).
• APS5_BINDLESS_MATERIAL_SCAN=65536.

How it was run

• relinker --windows --windows-fixed-base 0x400000000 --registry eboot.elf app.exe, the converted libc.prx in app0/sce_module, the rest of the dump linked into app0.
• Default GPU (RTX 5070), no other environment variables except tracing.

AI-assisted: yes (Claude Code ran the conversion, the runs and the analysis).

[simonbronk]

Progress on 2026-10-14:

• Checkerboard rendering: feat(agc): rasterize sample locations that vary between pixels through a 2x2 grid #5861 (sample locations varying between pixels, through a 2x2 grid) and feat(agc): rasterize a multisampled draw into one-sample targets at sample 0's locations #5907 (two-sample rasterization into one-sample color and stencil targets). With both, the draws at the first presentation go through.
• fix(agc): accept bindless image tables with entries wider than 32 bytes #5620's third commit (ee95066) replaces my local evaluable-key fix.
• Next stop: image descriptor is incompatible with the static runtime image interface: descriptor format 56 decodes to {class 1, dim 4 ...}, a 3D T# read where the program declares a 2D-array image. No open PR covers that combination yet (fix(shader): read 1D T#s through 3D image_sample and image_load accesses #5375, fix(shader): compare through 2D image_sample_c on 1D T#s #5456 and fix(shader): read cube T#s through DIM 2D image_sample and image_load as face 0 #5509 cover other ones).
• One run of two ended earlier, in the title's audio thread (AK::EventManager access violation, also seen in Resident Evil Village (PPSA01556) #5169).

AI-assisted (Claude Code).

[simonbronk]

First screens. With #5861 and #5907 (checkerboard), #5555 (merged today: a 2D-array access on a 3D T#) and the earlier fixes listed here, the title presents frames. Windows 11, RTX 5070, warm shader cache: the health warning screen, then the initial settings screen (display language selection), steady at about 15 FPS. It sits there waiting for input. The first run after a rebuild spends about 5 minutes compiling roughly 18,000 shaders.

The AK::EventManager access violation (also in #5169) still ends some runs before the first screen: 2 of the last 4 here.

AI-assisted (Claude Code).

[simonbronk]

Progress on 2026-10-15 (Windows 11, RTX 5070, warm shader cache). Base: main 0afa6a6 plus #5907 #5703 #5841 #5884 #5915 #5815. #5776 and #5770 merged today.

How far it gets: language, EULA, brightness and gamma screens, the main menu, New Game, difficulty and the controller-layout choice. Confirming the layout starts the first scene load, which ends in VK_ERROR_DEVICE_LOST (read invalid at 0x4840000), only with host imports on: #6374. With APS5_NO_HOST_IMPORT=1 the load stops on a 4-sample D32 depth read with non-ITERATE_256 HTILE: #6362.

The AK::EventManager crash (#6046) has not come back in any run on this base.

Performance on the menus: about 10 FPS, with the CPU as the bottleneck.

• Every minute or two the frame rate drops below 1 FPS for 15 to 20 s, even with no input. Each drop is a burst of guest munmap/mprotect calls, and each of them waits for GPU work because leases pin every registered range: AGC: whole-registry leases make every guest munmap/mprotect wait for GPU work; Onimusha (PPSA27836) drops below 1 FPS for 15-20 s at a time #6453.
• Image-table reuse (perf(agc): reuse eligible image table entries independently #6340) does not trigger in this title, since every element's lookup has no generation proof. The numbers are on that PR.
• During the first scene load, RAM commit grows from 34 to 43 GB and the card's VRAM peaks at 7.3 of 11.9 GiB, so the device loss is not VRAM exhaustion.

AI-assisted (Claude Code).