iiinova — where your digital self keeps evolving

vabold @vabold.bsky.social · 03/10/2026

Your friend got banned for intentionally harassing decomp contributors. This server isn't a debate club. We have actual work to do on decompilations.

000

vabold @vabold.bsky.social · 02/10/2026

High reasoning. I will also give the benefit of the doubt and say that it was moreso given the methodologies of how to get this information but not necessarily any clear direction to use it. I'll also point out I wasn't the one directing the model, just assessing the output against what I know.

010

vabold @vabold.bsky.social · 02/10/2026

For anybody looking for a summary of this 28-post thread:

0212

vabold @vabold.bsky.social · 02/10/2026

HOWEVER, I'm still unconvinced that this is something worth paying money for. Astra is obviously a very high-end model with a major dependency on OpenAI (or Anthropic), and frankly I don't think the money is best spent like this. With focused effort, I think a human still outperforms.

020

vabold @vabold.bsky.social · 02/10/2026

To wrap up, here is my takeaway: Astra is passable in initial reverse engineering sweeps and is very capable of decompilation with base knowledge. With the right management, I think it's possible to leverage this to get something high-quality and fast.

130

vabold @vabold.bsky.social · 02/10/2026

That isn't to say this is completely useless for reverse engineering. It found this to mean shutdown, and after cross-referencing Wii Shop Channel for clues, I found this was a function I had labeled a while ago called CNTShutdown.

100

vabold @vabold.bsky.social · 02/10/2026

Here, we see some misunderstanding of the HBM. Despite these function names all revolving around a "result", two of them correspond to a bitflag and one of them corresponds to a completely separate member. This switch statement is also meant to be of the return type of HBMCalc, an enum for buttons.

100

vabold @vabold.bsky.social · 02/10/2026

It's also misusing the term "configure", having pulled it from the vocabulary seen in the linker map, but not fully understanding its context. In the original library, this is meant to change the static pointer that the system classes have to the configuration data. We're seeing it bastardized here.

110

vabold @vabold.bsky.social · 02/10/2026

Going back to Astra's work, we see instantiation of this supposed System class that more strikingly resembles EGG::TSystem<>::Configuration. This assuredly is not templated, but this is the job the configuration has, not the system.

100

vabold @vabold.bsky.social · 02/10/2026

When going over scenes, I noticed a very familiar name pop up: Kiuchi. Upon further examination, I found two more familiar names: Kitayama and Masuda. Muraki, Minato, and Kando are absent and seem to be replaced with other developers I don't recognize (Itoy? Oshino? Kida? Kato?)

100

vabold @vabold.bsky.social · 02/10/2026

Big Brain Academy: Wii Degree uses the intended configuration setup. They have a more-or-less stock configuration and YSystem is omnipresent for any code that needs it. Which one of these three best fits Wii Speak? We don't have symbols, so it should be impossible to tell... but it's likely BBA:WD.

100

vabold @vabold.bsky.social · 02/10/2026

Pack Project (Wii Sports, Wii Play, etc) rely on RPSysSystem, which afaict wraps RPSysConfigData. However, it's one of the only system classes that has an instance. Zelda framework (Skyward Sword, New Super Mario Bros Wii) use a static system class called dSys_c, which houses everything statically.

100

vabold @vabold.bsky.social · 02/10/2026

talk* a bit, I'm writing this as I go.

000

vabold @vabold.bsky.social · 02/10/2026

All of the system classes are completely static and call into their respective instances of the ConfigurationData. Game classes sometimes operate the same way, but sometimes don't. Nintendo EAD was a big department, and there were many styles on how to handle this.

100

vabold @vabold.bsky.social · 02/10/2026

Let's take a bit about the normal side of EGG system classes. Everything is accessed from a ConfigurationData interface (which also houses some internal heap members), and all of the externally-provided managers live in a TSystem<>::Configuration instance. TSystem<> and BaseSystem are wrappers.

200

vabold @vabold.bsky.social · 02/10/2026

Takeaway 2/2: Astra is good at decompiling. Honestly. It's actually better than many humans I've seen who work on these kinds of games and fall into the trap of avoiding the omnipresent OOP we know exists. Astra's problems lie instead with the reverse engineering side.

100

vabold @vabold.bsky.social · 02/10/2026

This is the true test. It can't copy any code I've labeled in Ghidra or any code from Wii Sports. It must reverse engineer everything and decompile everything itself from here. It has a base to work with in the form of the original EGG system code. What can it do here?

100

vabold @vabold.bsky.social · 02/10/2026

While trying to manually reverse engineer Wii Speak's system code, I realized that their version of EGG is very heavily modified. The system code lies in between two known EGG TUs, making it an indisputable part of the library. We got bored of watching it copy Wii Sports, so we directed it to this.

100

vabold @vabold.bsky.social · 02/10/2026

Astra isn't using all of the resources it has at its disposal for correct answers. I realize this is likely a different story if we don't give it access to other decomp repositories, but it makes me feel correct in my understanding that LLMs will try to take as many shortcuts as possible.

200

vabold @vabold.bsky.social · 02/10/2026

Wii Speak weirdness aside, takeaway 1/2 came from the ColorFader constructor in attached image 1. For context, here's all the information we can glean from the constructor in attached image 2. The TBitFlag<u8> instantiation is missing! This solidified it was copying Wii Sports directly.

100

vabold @vabold.bsky.social · 02/10/2026

Because Astra was matching root heap creation functions in the Heap source file, this was an instant red flag that something was up with the system. While it continued work on Thread and TaskThread, I instantly knew something was up with the system classes and went to investigate.

100

vabold @vabold.bsky.social · 02/10/2026

Let's talk about the EGG system. Because EGG overrides operator new to use their heaps, the system has to initialize the heaps first before anything can happen. This is done by making a static configuration and calling a function called initMemory. Here's roughly what it looks like in MKW:

100

vabold @vabold.bsky.social · 02/10/2026

These are, as far as I can tell, new functions that don't exist in any other program that uses this library. invokeAllocCallback is an easy to understand change, but the root heap creation functions are very strange. The arena heaps are not instantiated like this.

100

vabold @vabold.bsky.social · 02/10/2026

The first thing it did, predictably, was start working on ExpHeap. This involves Heap, Disposer, and Allocator, so it started on those too. The code itself was nearly identical to the work we've previously done on it (with one fakematch for Heap::dumpAll), but something caught my eye immediately.

100

vabold @vabold.bsky.social · 02/10/2026

One very important thing I nearly forgot: we also gave it my Ghidra project files for EGG which has about 30 DOLs to look from (many are not labeled because I use a small minority).

100

vabold @vabold.bsky.social · 02/10/2026

With the knowledge of how to bootstrap into EGG TUs, and allowing it to cross-reference with existing decomp, we let it loose on EGG to see how it would do. I also gave it other reverse-engineering tricks I use frequently, such as how Big Brain Academy: Wii Degree's linker maps give matching clues.

100

vabold @vabold.bsky.social · 02/10/2026

We have three known link orders from here. One of them is the standard one from Big Brain Academy: Wii Degree. One of them is the subfolder-independent alphabetical order from Mario Kart Wii. The other one is subfolder-dependent alphabetical order from Wii Music.

100

vabold @vabold.bsky.social · 02/10/2026

If we look at the callers, we will eventually stumble upon a function with two more consecutive rlwinm instructions. It will call into it with notable constants 0x38 and 0x3c. This is EGG::ExpHeap::create, and all EGG projects will have this.

100

vabold @vabold.bsky.social · 02/10/2026

I'll be using the The Legend of Zelda: Skyward Sword Save Data Update Channel as reference because it has this library and I don't think anyone has ever cared to document it. Eventually, you will find this. The 0x45585048 means 'EXPH' in ASCII. This is an SDK function called MEMCreateExpHeapEx.

101

vabold @vabold.bsky.social · 02/10/2026

010101.. ........ 00000000 00111010 This is an rlwinm instruction with variable registers to round down to 0x4 alignment. Heap creation works by rounding up the start address and rounding down the end address, so two (near-)consecutive rlwinms generate next to each other.

100

vabold @vabold.bsky.social · 02/10/2026

It... pretty much just copied everything I knew as context and referenced Wii Sports heavily for implementation. To that end, I'll talk more about what I explained as bootstrap knowledge before we get into one of the more surprising outcomes. First things first, how do we find EGG to start with?

120

vabold @vabold.bsky.social · 02/10/2026

A few days ago, I got to see GPT-6 Astra try its hand at C++ decomp. We used Wii Speak as a proving ground, specifically with one of the first-party libraries called EGG. This is a library I have a lot of knowledge of and can comfortably navigate in Ghidra with zero reverse engineering. How'd it do?

151

vabold @vabold.bsky.social · 18/09/2026

It's always been possible to decompile without reverse engineering, but usually you can't get away with it. You have to sit with difficult functions for a while, and I think that time lends itself to reverse engineering. Maintainers should also generally avoid allowing low quality code in commits.

020

vabold @vabold.bsky.social · 18/09/2026

I'm so tired of decomps receiving the attention they've been getting. Call me a gatekeeper, selfish, whatever you want. I will happily try to support anyone who wants to get into decompiling GC/Wii games. The people I'm complaining about aren't and won't, and I don't want to hear from them anymore.

194

vabold @vabold.bsky.social · 18/09/2026

This isn't even to mention the conflation with recompilations, an inherently easier way to get PC ports. All of the average people who really don't care about decompilations and only want what they facilitate? They can't tell the difference. Put succinctly, slop supply meets slop demand.

190

vabold @vabold.bsky.social · 18/09/2026

On one hand, you have sycophants who brag about fully automating the decompilation process, and who claim the others who are still reverse engineering will be "left behind". On the other, you have dissenters who will attack you for even mentioning LLMs. Both sides are frustrating to deal with.

171

vabold @vabold.bsky.social · 18/09/2026

Now people think they understand what's happening and think they have a reason to care. What you end up with are people with strong opinions who understand nothing. LLMs can put in work and you can still end up with a high quality result. Obviously, this is too nuanced for social media.

170

vabold @vabold.bsky.social · 18/09/2026

Decomps have now become synonymous with the projects that they enable: PC ports. Twilight Princess with Dusklight, Super Mario 64 and Ocarina of Time have their respective ports. In my opinion, this has done more damage to the decompilation scene than LLMs ever did.

182

vabold @vabold.bsky.social · 18/09/2026

When you examine it in a vacuum, people see that LLM usage has gone up, and it directly relates to quality going down. It doesn't matter that the decomp reached 100% faster. This is the direct cause and effect the average person sees. Naturally, people don't understand the full nuance of this.

150

vabold @vabold.bsky.social · 18/09/2026

In reality, we're seeing a shift of what exactly 100% decomp is. It no longer means that the decomp is finished. It now only means that it matches. However, with percentage being the only measurable metric people can understand, they can't know the decomp isn't finished.

170

vabold @vabold.bsky.social · 18/09/2026

Decompilation and reverse engineering are now two separate processes. One is moving very fast along the only measurable metric. The other is now MUCH slower and perhaps even at a complete standstill. It's because of these processes separating that people assume quality's getting worse.

170

vabold @vabold.bsky.social · 18/09/2026

However, when people start examining the problem with LLMs in mind, they see the 100% goal and blindly use it as a reward function. Fakematches are back on the table. Code quality goes down. The time it takes for people to understand the code and write it cleanly is now lost by faster matching.

160

vabold @vabold.bsky.social · 18/09/2026

To that end, 100% is an implicit quality seal. The maintainers of the project understand the code enough to match it, and the time it's taken has allowed actual insight on the reverse engineering side. Decompilation and reverse engineering are working in tandem to make high-quality decomp.

160

vabold @vabold.bsky.social · 18/09/2026

In the beginning, there was manual code review, and this worked great. The compiler is difficult enough to force the decompilers to pay attention to the function. You don't get a pass to ignore it and move on. You HAVE to address it and try to understand the code you're working on.

140

vabold @vabold.bsky.social · 18/09/2026

Haven't posted on here in a minute, huh? I've been fine with LLM usage in decompilation for a while, with some exceptions for cases where the source can be leaked (e.g. SDK, nw4r, etc). That said, they are undoubtedly the driving force of public perception of decomp quality loss.

291

vabold @vabold.bsky.social · 08/05/2025

they call me 0x4201_127 the way I be E9 8B 0D 00 00ing my 0x1A8540

020

vabold @vabold.bsky.social · 21/03/2025

Thank you for your service

010

vabold @vabold.bsky.social · 19/03/2025

BREAKING: World's first unironic and non-deluded sentence with "MSVC" and "correctly" in it.

153

vabold @vabold.bsky.social · 14/02/2025

Nine months ago, kierio04 created an SNES Mario Circuit 3 TAS to help test basic driving mechanics, yet it critically also included basic pipe/oil patch collision for testing objects. Today, that test ghost finally fully synchronized. github.com/vabold/Kinok...

011