GameCube DOL verification, 2026-10-24¶

This records additional verification of PR #6240. The lane explicitly imports a static 32-bit big-endian PowerPC DOL through the existing POSIX Ghidra provider. It does not execute the target. Admission covers cached MEM1 (0x80000000..0x81800000); Wii MEM2, uncached aliases, REL/RPX, r2/r13 recovery and platform-specific instructions are outside this verification. No automatic DOL detection or new provider is introduced.

Sources and corrections¶

The measured feature-source pin is 7f892827610d8e0f14993c577ac48ba8ac1f7ea2. The comparison baseline is 2961f06776dcb73818980a2a5d6886a4fec1e521. Both include main 3ce311757dd8ac444c8297b2871464536f93816d, the contributor's DOL work and the shared inventory/caller/cleanup corrections below. Their production difference is the BSS ownership and qualified-address correction; this is not a comparison against main without DOL support. Contributor head 29b4608459a2a2c4d838135a569d3e5e7727a30e is retained in the final ancestry.

• A real Ghidra capture showed symbol provenance in both procedure inventories. The shared strict decoder rejected that existing bridge field, including on the inspected main implementation. The decoder now accepts the named optional symbol contract for both inventories; two captured-row controls fail before and pass after. The shared boundary selection passes all 23 checks.
• The verifier must request analyze_function / CLI function detail: complete after the earlier summary-default change. It now uses the shared cleanup owner for connection failures, mixed cleanup outcomes and final lineage checks. The MCP scenario also uses the existing application harness. The Go fixture narrows its ELF subject instead of asserting an incompatible union type.
• The header parser owns BSS gap derivation. Original data-slot order remains intact; a sorted private range list derives at most 12 gaps. The private v2 plan declares section/gap counts, including zero gaps. Java applies these exact ranges instead of recomputing them; attestation uses the same parsed facts. The 1,272-byte wire bound follows the 18-slot/12-gap uint32 format. The profile version changes to invalidate older interpretation identities.
• Attestation reuses the domain address parser for qualified coordinates. Foreign-space uninitialized observations remain observable without becoming MEM1 BSS; foreign-space file mappings produce a mismatch. Both added controls fail against the previous implementation instead of throwing on valid syntax.

The suspected entry-label problem was not reproduced: real Ghidra reported __start at the header entry, with USER_DEFINED symbol provenance from the pre-script. That is an imported analysis label, not an original DOL symbol. No entry naming change was made.

Tools and artifact¶

Executed on Linux x64 with Node 24.22.1, npm 11.16.0, two allowed CPUs, a 2 GiB Node heap and a 1 GiB Ghidra JVM heap. Verification-only tools were extracted under a temporary directory; no unrelated software or user configuration was installed or changed.

The host compiler was Clang 14.0.6. Its existing user ld.lld wrapper delegated to an x86-only linker, so the verifier selected the extracted real LLD by an explicit compiler wrapper; the user wrapper was left intact.

The source-owned fixture is compiled from the shipped C, assembly and linker script, then converted to DOL. Independent GNU readelf symbols/program headers and a separate DOL header reader establish section addresses, file bytes, entry, data and the uncovered BSS interval [0x80013008,0x80013030) (40 bytes). Data slot 1 overlaps the declared BSS and remains initialized.

• DOL SHA-256: 42490c9b86ad0b5034063f65a3feeec554f583cb21ed95f4248f2a7571120f3d.
• Persistent query ELF SHA-256: 1ae89c6a4b0e3b9c8d3415e4b4a7e3f83d3a310c3b40aa60abd333dd35d4f963.
• Both fresh verifier builds produce that same DOL digest. Their debug-bearing source ELFs differ by worktree, and are not claimed byte-identical.

Real-provider verification¶

node scripts/verify-real-ghidra-dol.mjs exits 0 at both source pins using stock PowerPC:BE:32:default. It exercises public CLI and MCP open/session, load-image attestation, entry and leaf inventory, the direct call, complete decompilation, global/tail/marker reads, uninitialized BSS reads, close and cleanup. Both report verified lineage with zero live owned descendants at the final observation. This does not establish that no children existed earlier.

The Gekko/Broadway language is absent from the installed catalog, so its optional pass is skipped. Windows, this session's macOS runtime, commercial GameCube/Wii images, other DOL layouts and console runtime behavior are unverified. The contributor's earlier macOS/commercial-image evidence remains their evidence; it was not rerun here.

Earlier unsuccessful attempts are retained as failures: the host linker wrapper failed before import; then the real inventory exposed the symbol decoder mismatch; after that fix, the old verifier interpreted summary delivery as a complete dossier. None counts as a completed performance baseline. The two successful stock CLI/MCP runs took 135.025 s / 106.206 CPU s / 1,387.105 MiB sampled peak family RSS before, and 65.520 s / 75.296 CPU s / 1,451.117 MiB after. These ordered runs had different cache history; they do not establish a speedup.

Completed query-task costs¶

The analyst task asks for artifact identity, provider/language binding, verified section/BSS mapping, entry and leaf, the direct call, complete decompilation and four byte reads. Each fresh actual stdio SDK session discovers the full catalog, performs 11 tool calls (8 distinct operations), validates used advertised input and output JSON Schemas with Ajv 2020, validates each structured reply, closes and checks lineage. All six tasks pass. All requested answer facts, including mapping observations, pseudocode, byte results and limitations, are identical; input DOL/ELF digests remain unchanged. The v2 analysis-profile identity changes, so complete Evidence objects and Evidence IDs are not claimed identical.

Three pairs ran in order before/after, after/before, before/after. Each task includes SDK/server/JVM startup, independent readelf/header checks, lazy schema compilation, result validation, trace writing and cleanup. OS/file caches were primed by validation runs. Compilation-cache history was not isolated; these are fresh-process runs with warm files, not controlled cold-cache runs. Tool acquisition, initial builds, token-estimator CPU, transport framing, stderr, prompts and actual model-specific tool conversion are excluded.

These are tokenx 1.3.0 estimates over all 27 reserialized JSON-RPC messages per task, including both text and structured content. They are not billed tokens or a measurement of model context. The catalog alone contributes 1,031,590 estimated tokens in the full RPC envelope (223 tools). Its separate name/description/inputSchema subset is 261,284 bytes / 72,459 estimated tokens; this is not an observed agent tool conversion. Tool-result estimates are 103,162 before and 103,146 after; requests and other protocol add 1,258. A 16-token difference in the whole task does not establish useful context savings. Complete retained Evidence remains accessible.

Observed before medians: 99.072 s elapsed, 95.836 CPU s, 1979.152 MiB sampled peak family RSS.

Observed after medians: 62.052 s elapsed, 60.857 CPU s, 1810.133 MiB sampled peak family RSS.

The ranges overlap and startup dominates; three pairs with unisolated caches on a shared host do not attribute these timing differences to the BSS change or establish a general performance gain. Controlled cold-cache costs and large commercial-image costs remain unmeasured. The structural improvement is one bounded interpretation of at most 18 sections and 12 gaps, without repeated range subtraction or whole-file parsing at the header boundary.

The SDK receive budget was explicitly 64 MiB. The sampler observes recursive process-family RSS every 50 ms; it can miss short-lived peaks and double-count shared pages. CPU is wait-accounted process-family time. Neither metric is a claim about exclusive physical memory or production-agent costs.

Source and workflow checks¶

• Final source: check:fast, full format:check, cached runtime/skill build and 326 passing checks / 3 skipped Windows runtime checks across 22 exact files. Coverage includes DOL CLI/MCP schemas, target admission, load-image tampering, header malformation/slot ordering, BSS gaps, launcher arguments, provider decline, raw/DOS/PowerPC compatibility, inventory decoding and cleanup owners.
• An earlier selection had 325 pass / 1 MCP 30-second timeout / 3 skip. The unchanged MCP case passed alone at the original deadline; the final complete 22-file selection then passes all 326 without increasing that deadline.
• Documentation and full formatting are checked again after this report. Simulated-provider scenarios do not add real Windows, Hopper or IDA coverage.

While preparing the final PR, main independently failed a release-test typecheck (main job) and JavaScript worker startup (main job). These are recorded baseline failures, not successful checks or automatic exemptions for unrelated future failures. The published head's CI must be assessed separately before any authorized bypass.

Final integration after main's ownership update¶

Source a853c0c0ee5ea5eb66924c2c0235b223ae9d87b0 integrates main d9660eb03271d0ce1859cf8720ca460701dd3322. The only conflict was the packaged Windows verifier: main's new command/workspace owner is retained exactly, with one additional ReaGhidraPrepareDol.java caller-directory collision fixture. No previous resource-owner implementation is restored.

The combined snapshot e267d92d7af33681620548d584e3d60622ec7abd (tree 5dd561143b516ae4ae5983fe8250608329f4cee6) includes that source and Android head e65ba83fa319dd34eaebce7d93d78d4e67cf8458, in addition to the merged IPS and IL2CPP work. 1,062 checks pass, 4 skip, none fail across the four features and the newly changed process/package owners. Skips cover three Windows launcher scenarios and the platform-specific adjacent-npm scenario. The cached build passes. check:fast fails only at main's already recorded releaseProposal.test.ts:378 includeFiles type error; it is not reported as passing. Standalone lint, full formatting and documentation are checked again on the integrated DOL source after this report.

The same combined snapshot also reruns the real stock Ghidra CLI/MCP DOL lane successfully after the process-owner changes: 111.490 s elapsed, 98.176 CPU s, 1448.965 MiB sampled peak family RSS. Section/BSS mapping, entry/callee, decompilation, bytes, unchanged DOL identity and final verified empty lineage pass. Gekko remains unavailable and skipped. The six paired query costs above retain their original source pins; the new ownership implementation was not rebenchmarked as a six-task series.

Android subsequently merges as f2fa7f648de3dfbac5de69f3c091a54ffd571015 on that same main parent. Its CI built report has 14,251 passing / 220 skipped tests; the source worker and release-test failures match main. That is context for the combined snapshot, not the CI outcome of the newly published DOL head.

Procedure-search contract verification¶

Source 95e4cdfa53b049855f0d2b68b0741dada41d3e68 replaces the remaining inline public search_procedures row definition with nativeInventoryRowsSchemas.names, the same owner used by complete native name/procedure inventories and retained views. The bridge decoder already preserved symbol; the old public schema rejected it. The previous all-five-tools test stripped symbol facts from its search fixture and therefore missed that consumer boundary.

The test now replays both real captured rows (generated FUN_80003100 and the pre-script's __start) with their source metadata. Before the fix, the standard SDK raises Structured content does not match the tool's output schema for the extra fields. After it, all 42 selected decoder, inventory-view, MCP, semantic-schema and DOL-session checks pass, covering complete, summary and retained-page delivery. The superseded inline row definition is removed; public search and list consumers share the domain row owner. Standalone lint, full formatting and cached build pass. Source checking reports only the same main release-test includeFiles error.

A fresh real stock-Ghidra SDK task adds a matching search_procedures call to the earlier analyst question. The result keeps both rows' symbol metadata, passes the actual advertised SDK/Ajv schemas, and agrees with the list result. All earlier requested mapping, byte, pseudocode, limitation and input-identity facts remain equal. Final process lineage is verified with no live descendants. This adds real search coverage; the earlier six paired tasks did not exercise public procedure search.

The first fresh task stops during Java readiness cleanup, before DOL import: Java exits 0 and its JDK 21 facts parse, but an observed process's ownership environment returns EACCES. Both recorded candidate PIDs are subsequently absent before a fresh session is attempted. The fresh session completes. Ownership checks remain enforced; no persistent cause was isolated, and the first attempt remains a failure. The row-schema correction is not claimed to fix that process-retirement observation.

The completed analyst task includes that failed attempt and retry:

Measured invocations total 109.358 s, 117.460 CPU s, 2,192,529 estimated RPC tokens, 13 calls and 36 messages. The largest sampled family RSS is 2039.742 MiB. Both catalog discoveries and the error reply are counted. The receipt-write span approximates 180.355 s including intervening diagnostics; diagnostic/model tokens and CPU, prompts, stderr, transport framing and actual model-specific tool conversion remain unmeasured. Each catalog has 223 tools; its input subset remains 72,459 estimated tokens / 261,284 bytes per attempt. The successful attempt makes 12 calls; it is a different task from the earlier 11-call pairs and does not establish a performance gain. Tokenx 1.3.0 estimates and the sampler limitations above still apply.

Full formatting and documentation are checked again after this addendum.