Additive, capability-gated turbo memory-scan path (CC10-CC16); the legacy and
async scan paths stay byte-for-byte unchanged.
- SIMD typed comparator (scan_compare_simd.c) + CC10 caps + CC11 first scan.
- CC12 local-cluster rescan; server-resident survivor sets (CC13 GET / CC14
END); unknown-value bitmap + NVMe snapshot with since-last narrowing and a
materialize-when-sparse handoff to a compact record list.
- Aliasing read engine (scan_alias.c): maps target physical pages into our pmap
via guarded not-present leaf-PTE writes, scanning in place at DRAM bandwidth.
Unified per-2MB-span derivation (proc_ptwalk_span_resolve) makes it page-size
agnostic; verify-before-trust + restore + verify-before-munmap reclaim keep it
safe-to-fail. Opt-in (TSE_ALIASING + TS_USE_ALIASING, default off); mdbg is the
floor. Verifies 1-in-16 maps (derivation is byte-proven, guards prevent faults
regardless) - ~30% faster than verify-every-map.
- Opt-in server-side parallel compare for the aliased exact-match streaming scan
(TSE_PARALLEL_COMPARE + TS_PARALLEL_COMPARE, default off) - for single-
connection clients; multi-connection clients fan out across connections instead.
- Region-parallel multi-pattern AOB scan (CMD_PROC_SCAN_AOB_MULTI, aob_scan.h):
splits the range into per-worker sub-ranges, each scanned once for all patterns
via a shared first-byte dispatch table. Wire and results unchanged.
- Region-classify query (0xBDAACC16): per-region cache attribute (uncached PCD
bit) + measured read throughput, so a client can opt out of slow/uncached
regions. Read-only; the server drops nothing.
HW-validated on FW 9.00.
PS5 debugger payload, inspired by Ctn's ps5debug 1.0b5 and
wire-compatible with it. Runs the wire-protocol server inside
SceShellCore via an umtx-loaded installer that injects the embedded
debugger ELF.
Features: process scan/RPC/ELF-inject, on-console scan, full
debugger (breakpoints, watchpoints, single-step, regs/FP/DR access),
kernel R/W, server-side Zydis disassembly, on-console Keystone
assembler (0xBDAA0024), foreground-app metadata (0xBDDD0006),
server-side RBP stack walk (CMD_PROC_READ_STACK), klog forwarder
(TCP 3232), rest-mode survival and a lot more.
Supports FW families 3.x / 4.0 / 4.x (incl. 4.51) / 5.x / 6.x /
7.x / 7.5x / 8.x via the kpatch routine in installer/source/main.c.
GPL-3.0-only.
Pharaoh2k