You Don't Know Jack — Static Recompilation

Turning the PS3 disc binary of Jellyvision's irreverent trivia classic into a native PC executable — no emulator required.

You Don't Know Jack (2011, THQ / Jellyvision) is the high-definition revival of the snarkiest quiz show in video games. Dis-or-Dat, the Jack Attack, the host's relentless sarcasm, and a fake-commercial sponsor break every other question — all driven by a Scaleform Flash UI and a mountain of pre-recorded audio. It shipped on PS3, Xbox 360, Wii, and PC… but the PS3 version, like most PS3 games, has never run anywhere but a PS3 or RPCS3.

This project takes the decrypted PS3 EBOOT.elf, lifts every PowerPC function to C/C++, and links it against ps3recomp — a set of HLE runtime libraries that replace the Cell/LV2 operating system with native host implementations. The goal: a standalone Windows executable that boots Jack straight to the host's barbs, no emulator in sight.

You bring your own legally-dumped disc. No game binaries, audio, or trivia content are included in this repository — only analysis metadata and the recompilation harness.

---

🎉 It renders

The PS3 disc binary, statically recompiled to native x86-64, drawing its own attract/legal screen through a D3D12 backend — the real Scaleform Flash UI, the game's own shaders (VS_Glyph, PS_TextTextureAlpha, PS_CxformTexture), logos, and dynamic text. No emulator. The window title is live telemetry: FPS: 32.00 | draws: 119 | 1280x720. Text glyphs are still partially garbled (a dynamic glyph-cache/upload fidelity bug — next on the list), but the pipeline is end-to-end functional.

---

Why this is a great recomp target

Your average AAA PS3 game is a Cell-saturated nightmare of SPU compute and bespoke renderers. You Don't Know Jack is the opposite. Under the hood it's almost entirely menus, a Flash UI, and audio — exactly the profile that static recompilation eats for breakfast:

• One self-contained 5.3 MB EBOOT. No separate .sprx modules to relocate and stitch in.
• 5,859 functions. Tiny next to a PhyreEngine title (flOw weighed in at 100k+).
• 265 imports across 23 libraries — and ps3recomp already implements 19 of them. The four it doesn't are all optional online/social features (matchmaking, PSN store, voice chat) that an offline single-player port can simply stub out.
• The 2 GB of disc data is 601 trivia/"prize" content packs, FMOD .fsb audio banks, and Scaleform .gfx flash — data, not code.

---

Current Status

Metric	Value
Title	YOU DON'T KNOW JACK
Title ID	BLUS30569 (USA, disc)
Engine	Custom (Scaleform Flash UI + FMOD audio)
Binary	EBOOT.elf — 5.2 MB, ELF64 big-endian PowerPC64, ET_EXEC
Entry	OPD 0x5309e8 → code 0x5ecf4, TOC 0x544370
Functions detected	5,859 (6,630 OPD descriptors)
Functions lifted to C	14,380 (5,859 base + 1,467 jump-table cases + 7,054 mid-function tail-entry wrappers)
Generated source	19 chunks, 656 MB (was 5.2 GB before the .rodata fix — see note)
Unique call targets	6,104
Imported libraries	23
Imported functions	265
Module coverage	19 / 23 libraries already implemented in ps3recomp
SPU usage	SPURS framework only (management-level; no raw SPU compute observed yet)
Target	Windows x86-64 (Linux planned)

Phase Progress

Phase	Status	Notes
Disc inventory	✅ Complete	2,709 files — 1 EBOOT, 601 prize_*.zip packs, .fsb audio banks, Scaleform .gfx
SELF decryption	✅ Complete	EBOOT.BIN → EBOOT.elf via ps3sce (retail key rev 7, APP SELF)
ELF structural analysis	✅ Complete	2 PT_LOAD segments, OPD/TOC resolved, entry point located
Function boundary detection	✅ Complete	5,859 functions seeded from the .opd descriptor table
Import / NID extraction	✅ Complete	265 NIDs across 23 libraries catalogued
Module coverage triage	✅ Complete	19/23 ready; 4 to stub (see below)
PPU lifting (→ C/C++)	✅ Complete	14,380 functions → 19 C++ chunks (656 MB) via ppu_lifter.py
Lifter .rodata fix	✅ Complete	new --code-end bound; killed a 5.2 GB → 656 MB source explosion
HLE NID table	✅ Complete	357 handlers / 18 modules (src/gen/ppu_hle_nids.cpp)
Boot harness (CMake)	✅ Complete	clang-cl, links prebuilt ps3recomp_runtime.lib
Build & link	✅ Complete	all 26 objects compile; ydkj_boot.exe (64 MB) links (1 fall-through stub)
First boot	✅ Runs real code	entry dispatched, TLS up, 170 MB heap allocated
Import-stub → HLE wiring	✅ Solved	new lifter --hle-stubs: all 265 stubs → ps3_hle_call(nid). Cleared the 0x39800000 wall (where gunstar is stuck)
Thread creation	✅ Wired	sys_ppu_thread_create NID → real lv2 thread spawn + generic thread-entry trampoline; the "AsyncLoad" worker runs
TOC-save on imports	✅ Fixed	save r2 to 0x28(r1) per PPC64 ABI — eliminated all the static-init corruption (the vtable sweep + 40 OOB)
bcctrl mistranslation	✅ Fixed	5,596 vtable calls were jumping to a garbage address; now dispatch via ps3_indirect_call
Thread / main stacks	✅ Fixed	VM grown to cover the 0xD0000000 stack region; 256 MB host stacks
Native VA mapping	🧪 Evaluated → reverted	guest==host (vm_base=0) is elegant but Windows can't map guest page 0 or 0x60000000–0xD0000000 (the game uses both); flat calloc VM kept
Display / GCM init	✅ Wired	cellVideoOut*, _cellGcmInitBody, GCM offset/config funcs
HLE pointer bridge	✅ Init path done	~26 pointer-out funcs across cellGame/VideoOut/NetCtl/Gcm/Audio/Spurs translated to vm_write*
Boots & runs game code	🎉 Reached	clears the full init sequence — registers RSX vblank/flip handlers, opens audio, inits SPURS, and runs the game's own FMOD engine. No crash (runs continuously)
Audio engine (FMOD)	✅ Inits	guest-memory audio buffers → the game's FMOD engine initializes cleanly (no more error 37)
RSX vblank driver	✅ Wired	ppu_guest_call + 60 Hz vblank-ticker thread; D3D12/null backends present, ready once the loop runs
SPU recompilation	🎉 Built	all 22 embedded SPU images lift + compile + link into the boot exe (~4,400 fns, 6.4 MB C). Added 9 missing SPU opcodes to the lifter; registered each image by fingerprint → lifted entry; cellSpursCreateTask dispatches to it (DMA shares vm_base, so SPU writes reach the PPU). Ready to run once boot reaches the first task.
Lifter correctness	✅ 3 bugs fixed	drilled the post-init hang to real PPC→x86 lifter bugs: rA=0 atomic addressing (infinite spin), non-trapping integer divide (SIGFPE), and merged function boundaries (frame/callee-saved corruption). Boundary recovery recovered 4303 functions and cut lifted output 656 MB → 124 MB.
Frame-drift root-cause	✅ fixed	proved a callee-saved register (r29, a loop count) was being reloaded as the TOC pointer after a callee with a drifted stack pointer clobbered its frame slot → 5.5M-iteration hang. Fix: restore r14–r31 from an entry snapshot (C local), not the corruptible frame slot — 42,869 restores rewritten. OOB accesses dropped to 0.
Merged-function splitting	✅ 452 → 1	a function allocates its frame once, so every stdu r1,-N prologue is a distinct function — split at all of them. Plus tail-call routing (b/bc/fall-through to a prologue → trampoline, not goto). Eliminated the shared-frame tail-entries that caused frame drift. func_003DC468 (a long-standing hang) now clears.
cellGcmGetLabelAddress	✅ guest ptr	returned a host pointer (→ OOB write); now returns a guest address into a label window. The boot reaches RSX label setup.
XER[CA] carry-lifter fix	✅ crash killer	srawi (and the subfc; shift; addze container-size idiom) weren't setting the PPC carry flag → off-by-one sizes → the 0xC708C708 poison crash. Fixed 2,953 sites; the crash is gone and boot advances through the full render setup.
Boot → main game loop	🎉 Reached	with the carry fix in, boot clears NP/trophy/pad/save-data init and enters the game's main loop (loc_000149E4), running continuously. CRT, static ctors, module load, FMOD — all cleared along the way.
Trophy / NP / pad ABI	✅ fixed	sceNpTrophyRegisterContext corrected to the real 5-arg ABI + fires the status callback; sceNpBasicGetEvent exact no-event code; cellPad NIDs corrected + big-endian guest-struct writes + a virtual pad on port 0. Each unblocked a boot phase.
Event-poll pacing	✅ ~6× faster	the main loop polls event queues with a 30 µs timeout; Windows' ~15.6 ms timer granularity inflated each poll to ~15 ms → a ~500× global slowdown. Sub-millisecond sys_event_queue_receive now returns immediately when empty (+ timeBeginPeriod(1)). Reaches online-init in ~20 s vs ~120 s; runs at ~60 Hz.
Render pipeline	✅ live D3D12	RSX command FIFO drained at 60 Hz, GCM sync-fence labels advance, and the D3D12 backend clears + flips a 1280×720 window every frame.
Scratch-slot callee-save lifter bug	✅ the systemic root	drilled the "only CLEAR_SURFACE" wall (via an RPCS3 golden-log oracle) to a single lifter bug: when the compiler reuses a callee-save register's stack slot for a local (std r29,0x90(r1) of a computed value, later ld r29,0x90(r1) to reload it), the lifter mistook the reload for a callee-save restore and rewrote it to the register's stale entry value. The first casualty was data.toc's file size (a stale pointer instead of 0x19B00) → its buffer alloc failed → total downstream corruption. Fix: a std rN,off(r1) only counts as a save if rN hasn't been reassigned first (it must store the entry value). One rule, applied at the lifter — cleared the corruption globally.
🎉 First pixels — the game renders	✅ REACHED	with the lifter fix in, data.toc loads (105,216 B), the abort() is gone, and the RSX FIFO issues real DRAW_ARRAYS / DRAW_INDEX_ARRAY through the D3D12 backend. The Scaleform attract/legal screen draws — logos, shapes, and text via the game's own shaders. See the screenshot at the top.
Glyph-cache text fidelity	⏳ known	logos (static textures) are pixel-perfect; some dynamic text runs are torn/garbled — the 1024×1024 glyph atlas (PS_TextTextureAlpha) is sampled with wrong per-run texgen/UV data (the atlas itself is clean). A shader/vertex-level fidelity bug on top of a fully-working pipeline.
SPURS / libsre bring-up	✅ init + taskset work	libsre (Sony's cellSpurs/cellSync PRX) is lifted with the same toolchain — it had two bugs: the systemic callee-save issue above, and a re-lift --code-end that excluded the import PLT so every bl to _sys_memset/_sys_spu_image_import became a silent no-op (→ SPURS attribute never zeroed → cellSpursInitializeWithAttribute/CreateTaskset failed 0x80410702/0x80410811). With --code-end 0x3001DB18 the imports resolve: SPURS init + taskset creation now succeed, and the completion event queue (q=1) starts receiving events. (Firmware/SDK mismatch ruled out — same libsre builds and validates the attribute.)
Advance past the attract screen	⏳ current frontier	the legal/attract screen is the logo-video screen, waiting for Logos.usm to play and finish. A 5.5-min run confirms it's not timer-gated — it waits indefinitely. The cri taskset is created but cellSpursCreateTask is never called: the movie decode never starts, so no SPU decode task, so no frames, so the video never completes. Getting past it = the cri_mpv → SPU video-decode chain (see CRI_MPV_CONTENT_PLAN.md): stream/buffer the movie → cri_mpv creates the decode task → SPU decodes → real q=1 completion → video plays. 🎯

🔬 War story: the 5.2 GB lift, and the one-line ISA detail that caused it. The first full lift produced 5.2 GB of C++ (≈600k lines/chunk) — absurd for a 5 MB binary (flОw's 100k+ functions were ~156 MB). The hunt:

1. Found one mis-detected 634 KB "function" that ran to the end of the code segment — but clipping it changed nothing.
2. Found 1,617 garbage functions at .rodata addresses (func_005xxxxx), each lifting tens of thousands of /* TODO: .word */ junk "instructions."
3. Root cause: PS3 EBOOTs pack .rodata into the same R-X segment as .text. A bc-form (conditional branch) data word whose 16-bit immediate happens to point into that rodata was promoted by the lifter to a func_X jump target; the mid-function pass then re-emitted it to the next boundary — a quadratic blowup seeded by random data that merely decodes as a branch.

Fix: a new opt-in --code-end bound in ppu_lifter.py. The ELF section headers say executable code ends at 0x4874E0; any branch/call/jump-table target at or beyond that is treated as data, not a function. Result: 5.2 GB → 656 MB, 131 → 19 chunks, 0 bogus rodata functions. The remaining .word/vmx TODOs are genuine undecoded AltiVec/VMX SIMD in real functions (the same class flОw carries) — implemented as the boot progresses, not bloat.

---

First Boot

ydkj_boot.exe loads the decrypted EBOOT, registers the 14,380 lifted functions and 357 HLE handlers, and dispatches the real entry point. It gets impressively far:

[ppu] loaded 2 PT_LOAD segments, entry OPD 0x005309E8
[ppu] TLS image 0x10F00000 (r13/TP=0x10F07000)
[ppu] run: code 0x0005ECF4, toc 0x00544370, sp 0x0FF00000
[sys_memory] allocate(size=0xAA00000, flags=0x400)   ← game requests its 170 MB main heap
[sys_memory] allocate -> 0x40000000                  ← granted
[ppu] unresolved indirect call -> 0x39800000  (r12=0x00470870, the real target)
[ppu] lv2_syscall 988 (stub) × N
[ppu] FATAL: stuck calling 0x39800000 (2000 times) -- aborting run

The first build stalled on bctrl → 0x39800000 (the bytes of li r12,0) — the firmware-import-stub wall that also blocks Gunstar. The cause: the lifter emitted the literal .lib.stub trampolines, which dereference an import pointer table the recomp never fills. The fix is a new generic lifter flag --hle-stubs that rewrites each of the 265 import stubs to ps3_hle_call(nid, ctx) — dispatching straight to the registered HLE handler. That cleared the wall:

[crt] sys_initialize_tls: block 0x0E000000, r13=0x0E007000   ← TLS init runs
[sys_memory] allocate(0xAA00000) -> 0x40000000               ← 170 MB heap
[hle] unresolved NID 0x24A1EA07                              ← = sys_ppu_thread_create
[ppu] unresolved indirect call -> 0x40000030 .. 0x40000120   ← static-init vtable sweep

So the recompiled CRT now runs much deeper — TLS, heap, and into thread creation / C++ static constructors. The next blocker is identified precisely: sys_ppu_thread_create (NID 0x24A1EA07) is imported via sysPrxForUser but ps3recomp implements thread creation as a syscall, so the NID is unwired; the CRT's thread/static-init then walks an uninitialized object table at the heap base and calls heap addresses as function pointers. Bridging the sys_ppu_thread_* NIDs is the next step. Full trace: docs/BOOT_TRACE.txt.

Module Coverage

Of the 23 firmware libraries the game imports, ps3recomp already ships real host implementations for 19. The remaining four are all online/social and can be stubbed for an offline port.

Library	NIDs	ps3recomp status
sysPrxForUser	26	✅ Complete — threads, lwmutex/lwcond, heap, libc
cellGcmSys	22	✅ Complete — RSX command buffer + state
sys_fs	18	✅ Complete — file I/O w/ host path mapping
cellRudp	17	✅ Complete — reliable UDP
cellSysutil	17	✅ Complete — callbacks, system params, BGM
cellSpurs	15	🟡 Partial — management only (no SPU execution)
sys_net	14	✅ Complete — BSD sockets
cellAudio	10	✅ Complete — WASAPI / SDL2 mixing
sceNpTrophy	9	✅ Complete — persistent trophy storage
cellHttp	6	✅ Complete — HTTP/1.1
sys_io	6	🟡 Stub — low-level pad I/O syscalls
cellGame	5	✅ Complete — boot/content dirs
cellNetCtl	5	✅ Complete — network control
sceNp	27	✅ Complete — NP core
cellSync	3	✅ Complete — sync primitives
cellSysmodule	3	✅ Complete — module tracking
cellSsl	3	✅ Complete — SSL/TLS
cellRtc	2	✅ Complete — real-time clock
cellUserInfo	2	✅ Complete — default user
cellSaveData	1	✅ Complete — save/load
sceNp2	28	⛔ TODO — NP2 matchmaking/rooms (stub for offline)
sceNpCommerce2	16	⛔ TODO — PSN store / DLC (stub for offline)
cellSysutilAvc2	10	⛔ TODO — audio/video (voice) chat (stub for offline)

---

How It Works

EBOOT.BIN  ──ps3sce──▶  EBOOT.elf  ──ppu_loader──▶  meta/*.json
 (SELF, encrypted)     (PPC64 BE)      │  (image, OPD/TOC, functions, imports)
                                       ▼
                                  ppu_lifter  ──▶  src/recomp/*.cpp   (lifted PPC → C)
                                       │
                                       ▼
            ps3recomp runtime  +  generated HLE NID table  ──CMake/clang-cl──▶  ydkj.exe
            (LV2 syscalls, cellXxx HLE, vm, big-endian memory)

ps3recomp does the heavy lifting on the runtime side; this repo is the per-game project: the decryption recipe, the analysis metadata, the module configuration, and (soon) the lifted code + boot harness.

Repository Layout

project/
├── config.toml          # module map + loader/lift constants for this title
├── CMakeLists.txt       # clang-cl boot harness (links ps3recomp_runtime.lib)
├── meta/                # analysis output (committed — pure metadata, no game code)
│   ├── EBOOT.functions.json   # 5,859 function boundaries (rodata-clipped)
│   ├── EBOOT.functions.raw.json # raw detector output, for provenance
│   ├── EBOOT.imports.json     # 265 NIDs × 23 libraries
│   ├── EBOOT.image.json       # segment manifest
│   ├── EBOOT.loader.json      # entry / OPD / TOC
│   └── elf_analysis.json      # ELF headers / segments / sections
├── src/
│   ├── gen/             # generated HLE NID table (committed)
│   ├── compat/          # Win32 <dirent.h>/<unistd.h> shims (committed)
│   └── recomp/          # 656 MB of lifted PPU→C (generated; gitignored)
└── input/               # YOUR decrypted EBOOT goes here (gitignored)

Reproducing the analysis

# 1. Extract the EBOOT from your own disc dump
7z e "You Don't Know Jack (USA).7z" "...\PS3_GAME\USRDIR\EBOOT.BIN" -oinput/

# 2. Decrypt the retail SELF → ELF
ps3sce -d input/EBOOT.BIN input/EBOOT.elf

# 3. Load: image + OPD/TOC + function table + imports
python <ps3recomp>/tools/ppu_loader.py input/EBOOT.elf --output meta/

# 4. Lift PPU -> C, bounding targets to .text so .rodata doesn't explode
python <ps3recomp>/tools/ppu_lifter.py input/EBOOT.elf \
    --functions meta/EBOOT.functions.json --output src/recomp \
    --header-name ppu_recomp.h --source-name ppu_recomp \
    --jobs 1 --code-end 0x4874E0 --hle-stubs meta/EBOOT.imports.json

# 5. Generate the HLE NID dispatch table for the imported libraries
python <ps3recomp>/tools/gen_hle_nids.py cellAudio cellGcmSys ... \
    --out src/gen/ppu_hle_nids.cpp

# 6. Build the boot harness (clang-cl, links the prebuilt runtime lib)
cmake -S . -B build -G Ninja -DCMAKE_C_COMPILER=clang-cl -DCMAKE_CXX_COMPILER=clang-cl
cmake --build build
./build/ydkj_boot input/EBOOT.elf

---

Credits & Legal

Built on ps3recomp, in the lineage of N64Recomp, UnleashedRecomp, and friends.

You Don't Know Jack is © Jellyvision / THQ. This project contains no copyrighted game code, assets, or audio — only analysis metadata derived from a binary you must legally own. It exists for preservation, interoperability, and the sheer joy of making a Cell processor's worst nightmare run on a laptop. Bring your own disc.

License

The code in this repo is MIT: see LICENSE. Code generated from the game or the firmware (src/recomp/, prx/**/ppu_recomp*, prx/**/spu_recomp*) is made locally from your own copy and never committed.