sp00nznet/ps3recomp

Static recompilation runtime libraries for PlayStation 3 titles. Turn PS3 binaries into native executables. No emulator required.

Join the sp00nznet recomp Discord — the community hub for sp00nznet's recomp projects, where ps3recomp development happens in the open. Good place to ask questions, show a port you are working on, or find out what people are stuck on before you duplicate the effort.

ps3recomp is an open-source toolkit that provides the runtime libraries, system stubs, and analysis tools needed to statically recompile PlayStation 3 games into native PC executables.

Instead of interpreting or dynamically recompiling PowerPC/SPU instructions at runtime (what emulators like RPCS3 do brilliantly), we take the opposite approach: translate everything ahead of time into C/C++ that compiles with your favorite compiler on any modern platform.

This is the same philosophy behind:

• N64Recomp (N64 -> native)
• UnleashedRecomp (Xbox 360 -> native)
• PS2Recomp (PS2 -> native)
• burnout3 (Original Xbox -> native)
• ReXGlue (Xbox 360 -> native)
• AnyPS5 (PS5 -> native)

...but for the PS3's glorious, terrifying Cell Broadband Engine.

The PlayStation 3 has over 3,000 titles and some of the most beloved games ever made. RPCS3 has done heroic work making ~70% of the library playable through emulation, but static recompilation offers something different:

• Native performance — no runtime translation overhead
• Lower hardware requirements — runs on mid-range PCs
• Moddability — recompiled C/C++ is infinitely more hackable than PPC binaries
• Preservation — native ports survive long after emulators stop being maintained
• Portability — the output is C/C++, so it can target any platform a compiler does (see platform support for where the runtime actually stands today)

CI builds and tests every row on every pull request: Windows (clang-cl), macOS arm64, Linux (GCC and Clang), and Linux with the Vulkan backend on lavapipe under the validation layer. A green check means the runtime built and the tests passed. It does not mean a game ran; the last row is the only one that claims that.

What stops macOS and Linux running a title is the PPU boot scaffold. ppu_loader.cpp, boot_main.cpp and the HLE dispatch are compiled per game, not into the library. They compile on POSIX with zero errors (a CI ratchet keeps it that way) and the frame clock runs there, but no title has yet been booted to gameplay from this tree on either OS.

The renderers are further along than that. ps3recomp_host drives cellGcm → RSX → backend end to end with no game. With guest programs on, Metal and Vulkan both run the title's own shaders on the shared register-file draw engine. Every ps3recomp_host scene passes on both, including render-to-texture, MRT, depth textures, cube maps and stencil. Linux's default stays the headless null backend, a CPU triangle filler that CI draws with.

Downstream, people are already past this. Twisted Metal's menus run on Linux/Vulkan, inFamous on macOS, and Killzone 3 under Proton (see In the community). Those ports carry patches that are still on their way upstream, which is why the table still says "no".

The PS3's Cell processor is a beast unlike anything else:

We don't shy away from hard problems. We just break them into smaller ones.

ps3recomp/
├── tools/                    # Binary analysis & recompilation pipeline
│   ├── elf_parser.py         # Parse PS3 ELF/SELF/PRX binaries
│   ├── ppu_disasm.py         # PowerPC disassembler with PS3 extensions
│   ├── ppu_lifter.py         # PPU assembly -> C code lifter
│   ├── spu_disasm.py         # SPU instruction set disassembler
│   ├── spu_lifter.py         # SPU assembly -> C code lifter
│   ├── extract_spu_images.py # Extract embedded SPU images from PRX/ELF
│   ├── find_spu_functions.py # SPU function boundary detection
│   ├── wrap_spu_elf.py       # Wrap a raw SPU blob as a loadable ELF
│   ├── prx_analyzer.py       # Analyze PRX imports/exports and NIDs
│   ├── nid_database.py       # Function Name ID (NID) resolver
│   ├── find_functions.py     # Function boundary detection
│   └── generate_stubs.py     # Generate HLE stub skeletons from a NID list
│
├── runtime/                  # Core runtime for recompiled executables
│   ├── ppu/                  # PPU execution context
│   │   ├── ppu_context.h     # Register file, CR, LR, CTR, FPSCR
│   │   ├── ppu_memory.h      # Memory access macros (loads, stores, byte-swap)
│   │   └── ppu_ops.h         # Instruction operation macros
│   ├── spu/                  # SPU execution context
│   │   ├── spu_context.h     # 128×128-bit register file, 256KB local store, image_id
│   │   ├── spu_channels.c    # Channel ops + per-image function-table dispatch
│   │   ├── spu_helpers.h     # SPU intrinsics (incl. float conversions)
│   │   ├── spu_dma.h         # DMA (MFC) transfer engine
│   │   └── tests/            # Self-contained SPU runtime tests
│   ├── memory/               # Memory subsystem
│   │   └── vm.h              # Virtual memory manager (256MB address space)
│   └── syscalls/             # LV2 kernel system call implementations
│       ├── sys_ppu_thread.h  # Thread creation/management
│       ├── sys_mutex.h       # Mutex/cond synchronization
│       ├── sys_memory.h      # Memory allocation/mapping
│       ├── sys_fs.h          # Filesystem operations
│       └── lv2_syscall_table.h # Full syscall dispatch table
│
├── libs/                     # HLE library implementations
│   ├── audio/                # cellAudio, cellAdec, libmixer, libsnd3, libsynth2
│   ├── video/                # cellGcmSys, cellResc, cellVideoOut, cellVpost, cellVdec
│   ├── input/                # cellPad, cellKb, cellMouse
│   ├── hardware/             # cellGem, cellCamera, cellUsbd
│   ├── network/              # cellNetCtl, cellHttp, cellHttps, cellSsl, sceNp*
│   ├── filesystem/           # cellFs, cellGame, cellSaveData, cellStorage
│   ├── system/               # cellSysutil, cellSysmodule, cellRtc, sysPrxForUser
│   ├── spurs/                # cellSpurs, cellFiber, cellSpursJq, cellDaisy (SPU task management)
│   ├── sync/                 # cellSync, cellSync2 (cross-PPU/SPU synchronization)
│   ├── codec/                # cellJpgDec, cellPngDec, cellGifDec, cellPamf, cellDmux, cellAdecAtrac3p, cellAdecCelp8, cellVdecDivx
│   ├── font/                 # cellFont, cellFontFT, cellFreeType, cellL10n
│   └── misc/                 # cellScreenshot, cellSubdisplay, cellImeJp, cellVideoExport, cellMusicExport, cellGameRecording, etc.
│
├── include/ps3emu/           # Public API headers
│   ├── ps3types.h            # Fundamental PS3 types (u8-u128, s8-s64, be_t<>)
│   ├── endian.h              # Big-endian <-> little-endian conversion
│   ├── nid.h                 # NID hashing and lookup
│   ├── module.h              # Module registration framework
│   └── error_codes.h         # PS3 system error codes (CELL_OK, CELL_E*)
│
├── templates/project/        # Starter template for new game ports
│   ├── CMakeLists.txt        # Build system
│   ├── main.cpp              # Application entry point
│   ├── stubs.cpp             # Game-specific function overrides
│   └── config.toml           # Recompiler configuration
│
├── config/                   # Reference configurations
│   └── example.toml          # Example recompilation config
│
└── docs/                     # See the Documentation table below

The pipeline follows the same proven approach as our burnout3 project, adapted for the Cell architecture:

   PS3 Game Disc / PKG
         │
         ▼
   ┌─────────────┐
   │  SELF/EBOOT  │  Encrypted PS3 executable
   │  Decryption  │  (requires keys / fSELF)
   └──────┬──────┘
          │
          ▼
   ┌─────────────┐
   │  ELF Parser  │  Extract sections, segments, relocations
   │  + PRX Scan  │  Identify imported NIDs & library deps
   └──────┬──────┘
          │
          ▼
   ┌─────────────┐
   │  PPU Disasm  │  Disassemble PowerPC 64-bit + VMX
   │  + Analysis  │  Function boundaries, jump tables, ABI
   └──────┬──────┘
          │
          ▼
   ┌─────────────┐
   │  PPU Lifter  │  PowerPC → C code generation
   │  + SPU Lift  │  SPU programs → C code generation
   └──────┬──────┘
          │
          ▼
   ┌─────────────┐
   │  Link with   │  ps3recomp runtime + HLE libs
   │  Runtime     │  Provides all PS3 OS services
   └──────┬──────┘
          │
          ▼
   ┌─────────────┐
   │  Compile &   │  MSVC / GCC / Clang
   │  Ship!       │  Native x86-64 executable
   └─────────────┘

The SPU is the elephant in the room. Each SPU has its own instruction set, its own 256KB memory, and communicates with the PPU via DMA and mailbox channels. Our approach:

1. SPU programs are self-contained — they live in ELF segments loaded to local store (extract_spu_images.py pulls them out of PRX/ELF)
2. Recompile each SPU program separately — dedicated spu_disasm.py + spu_lifter.py handle the SPU ISA
3. SPU local store becomes an array — 256KB per "virtual SPU"
4. DMA operations become memcpy — via the MFC engine (spu_dma.h)
5. Channels become cross-thread message queues — preserving ordering guarantees
6. Per-image function-table dispatch — image_id lets multiple SPU programs (e.g. a SPURS kernel, a policy module, and a job) coexist at overlapping local-store addresses

This mirrors how RPCS3 handles SPU but at compile time rather than runtime. The disassembler, lifter, and runtime are functional and covered by self-contained tests (runtime/spu/tests/: sum, shufb, DMA, brsl-return).

HLE implementations of the PS3 system libraries, written for this project. RPCS3 is a behavioural reference, not a code source. About 93 modules complete and 5 partial (media decode, SPURS), in roughly 260 files and 100,000 lines under libs/.

Full status tracking: docs/MODULE_STATUS.md

We've written extensive docs covering every aspect of the project. Whether you're contributing, porting a game, or just trying to understand how PS3 static recompilation works, there's a doc for you.

Downloads: each release includes a prebuilt SDK bundle per platform (ps3recomp-<version>-win-x64.zip, -mac-arm64.zip, -linux-x64.zip) plus SHA256SUMS.txt. A bundle contains the runtime library, its headers and the Python pipeline. VERSION.txt inside it says what that platform can and cannot do yet.

Prerequisites (building from source): Python 3.10+, CMake 3.20+, a C17/C++20 compiler (MSVC 19.x / clang-cl, GCC 12+, or Clang 15+)

git clone https://github.com/sp00nznet/ps3recomp.git
cd ps3recomp
pip install -r requirements.txt

# Stage 1: image, OPD function table, TOC and firmware imports
python tools/ppu_loader.py /path/to/EBOOT.ELF -o out/

# Stage 2: lift to C++. --hle-stubs turns each firmware import stub into
# ps3_hle_call(nid); leave it out and the first import call crashes the port.
python tools/ppu_lifter.py /path/to/EBOOT.ELF \
    --functions out/EBOOT.functions.json \
    --hle-stubs out/EBOOT.imports.json \
    --output templates/project/recompiled/

# Stage 3: the NID -> HLE handler table, next to the lifted code
python tools/gen_hle_nids.py --all --out templates/project/recompiled/ppu_hle_nids.cpp

# Build the port from the template (RECOMP_DIR defaults to ./recompiled)
cd templates/project
cmake -B build -G Ninja
cmake --build build

See docs/GETTING_STARTED.md for the full walkthrough.

Status as of 2026-10-12. Each port's own README carries the live detail and the run recipe.

Not under active development; they are where much of the runtime was first proven, and several stay in the regression gate.

Ports other people are running on ps3recomp, whose fixes come back upstream:

• inFamous (@NoahBPeterson): in game on macOS/arm64 at around 13 fps, booting on Sony's own liblv2 and libsre (LLE). Its exact SPU float and VMX work landed in v0.15.0 (#286, #287), and @erikomis's inFAMOUS 2 bring-up on the same branch sent six fixes (#311-#316).
• Twisted Metal (@Kurtisone): menus on Linux/Vulkan, the deferred renderer's lighting and post-FX included. Most of v0.14.0's draw-engine and Vulkan work came out of this port.
• Killzone 3 (@undecuple): reaches the first level with geometry, lighting, shadows and depth of field (Windows build, run under Proton). 33 of its general fixes landed in v0.15.0 (#214).
• LittleBigPlanet (@sagemono), Yakuza: Dead Souls (@canersaka), God of War II HD and Ben 10 Omniverse (@andrebrumdev), and DBZ Budokai HD (@gnome41).

Ask in the Discord to get yours listed.

Want to port a game? Start with the Getting Started section, check docs/MODULE_STATUS.md for system library coverage, and see the Game Porting Guide for a real-world walkthrough.

• RPCS3: a behavioural reference for HLE modules and syscalls. We read what it does and then write our own. No RPCS3 (GPL) code belongs in this tree.
• Direct3D 12 / Metal / Vulkan: RSX graphics translation. D3D12 is the backend that runs games in this tree today. Metal (macOS) and Vulkan (Linux, opt-in, see docs/BUILDING.md) run guest shaders on the shared draw engine. CI draws with the headless null backend.
• SDL2: input and audio off Windows. cellPad and cellAudio always use their SDL2 backends on non-Windows hosts, so SDL2 is required there; on Windows they use XInput and WASAPI. SDL2 does no windowing here; each graphics backend makes its own.
• FFmpeg (optional, loaded at run time): video decode for cellVdec and ATRAC3plus for cellAtrac. It is never linked and never vendored.

This is a massive undertaking and we need help. Here's how to get involved:

• HLE Module Authors — Fill in the partial modules (media decode, SPURS edge cases) from documented behaviour
• PPU/SPU Experts — Improve the disassembler and lifter accuracy
• Graphics Engineers — Bring Metal and Vulkan to D3D12 parity, then run a title on them
• Game Testers — Try recompiling titles and report what breaks
• Documentation — Help us map out the PS3's system library landscape

See CONTRIBUTING.md for guidelines.

Not sure where to start, or want to sanity-check an idea first? Ask in the Discord — several of the people working on ports and on the lifter are there.

This project does not contain any proprietary Sony code, firmware, encryption keys, or copyrighted material (docs/FIRMWARE_LLE.md explains how LLE works without shipping firmware). It provides clean-room implementations of system library interfaces based on publicly documented behavior. You must provide your own legally obtained PS3 game files.

Contributors are credited in CONTRIBUTORS.md.

MIT License. See LICENSE for details.

76 pull requests from six contributors, merged in #325. They come from five ports in progress: Killzone 2 and 3, inFAMOUS and inFAMOUS 2, and Twisted Metal, plus tekulvw's correctness sweep of the runtime and Metal. Every change ships with a test or a measurement.

SPU and SPURS

• Hardware-exact SPU float (@NoahBPeterson, #287). Single precision now follows the ISA: extended range, truncation, denormal flush and saturation. frest uses the hardware table. Results are checked against an exact-arithmetic referee, and NEON paths run 1.6-4x faster with bit-identical output. This replaces the previous GPL-derived float code.
• SPURS policy scheduling (@tekulvw, #291). Each instance gets a coordinator and nSpus persistent workers, with admission capped by each workload's contention, so a waiting consumer no longer starves its producer. Every live SPU context also keeps private DMA and reservation state (#290).
• Interpreter fallback resumes lifted code (#266), and machine status reports the interrupt-enable bit (#289). MFC SDCRZ is implemented (#295), FNMS keeps its addend for zero times an extended operand (#318), and parked-list diagnostics are bounded (#298). SPURS task exit-code containers (#283), taskset storage size (#284) and TaskInfo requeue masking (#306) (@tekulvw).
• build_spu_workloads.py --input discovers, validates and registers SPU ELFs from supplied files, and the project template runs it (@tekulvw, #288).
• SPU_RdDec no longer wraps 231 s after its base stamp (@erikomis, #313).
• From @undecuple: the SMC micro-interpreter addresses lqa/stqa at I16 << 2 (#268). The MFC engine table grows past eight contexts (#272, later replaced by #290's unbounded registry). The policy module's u64 argument is passed in the preferred doubleword (#309), and _cellSpursAttributeInitialize gets its SDK argument order (#310).

PPU lifter and loader

• Exact VMX (@NoahBPeterson, #286). About 45 VMX ops that lifted as no-ops are now implemented, along with VSCR saturation and CR6 compares. BO/BI branches are decoded (bdnzt and bdzf were always taken), CTR is 64-bit, and get-PC idioms are recognised.
• From @undecuple:
  • big-endian lane order for ten VMX integer ops (#269);
  • lwax jump tables (#285);
  • sc at the end of a function falls through (#297);
  • a carry-form definition is no longer mistaken for a callee-save restore (#320);
  • --chunks N cuts lifted source by guest address and rewrites only the files that changed (#254).
• Loader, from @undecuple: TLS blocks sized by the TLS image (#253), a per-coroutine indirect-call depth guard (#270), and thread-locals that stay thread-local under MinGW (#271).
• Jump tables behind a tail-call epilogue are found (@erikomis, #311).
• Boot, from @tekulvw: PPU entry argv/envp live in stack-owned storage (#263), and HLE registrations regenerate when library sources change (#262).

RSX, draw engine, Metal and Vulkan

• Depth: from @undecuple, fragment depth export (#279), depth buffers sampled as textures return real depth (#280), and Z16 clear values are decoded (#282). From @tekulvw, 2D depth-compare textures (#302), depth24 endpoints preserved (#299), depth export in the shader cache keys (#301), and Metal depth attachments read back to guest memory (#300). From @Kurtisone, the depth bounds test (#319).
• Colour: from @tekulvw, sRGB framebuffer output (#304), per-channel texture input gamma (#305), fragment colour inputs clamped before source modifiers (#303), and register-fed DATA3F/DATA4F immediate vertices (#292).
• Fragment decompiler: predicated writes are a select, not a lerp (@undecuple, #278). The NV40 pack/unpack opcodes are implemented (@erikomis, #314).
• Antialiased surfaces render at sample resolution (#281), and the sampler cache key covers every field it decodes (#321) (@undecuple).
• Metal:
  • from @tekulvw: owned colour targets snapshotted in GPU order (#307), clears replayed over complete surfaces (#293), real window-close reporting (#308), and opt-in PS3RECOMP_METAL_FPS frame timing (#294);
  • from @erikomis: a command buffer that fails is reported (#316).

cellGcm

• From @undecuple: IO mapping table 16 -> 512 with no leak on refusal (#255), GET_REPORT honours its DMA context (#256), FIFO user commands reach cellGcmSetUserHandler (#273), and the in-FIFO flip wraps only the runtime's own ring (#275).
• Strict-order IO mapping (@tekulvw, #248). A parked FIFO gets time to be patched before the walker follows put (@erikomis, #312).

System libraries

• cellFs: directory entries (@tekulvw, #247), configured disc roots (@tekulvw, #249), GetFreeSize/Chmod/Utime/SdataOpenByFd (#257), and 64-bit sizes on Windows (#258).
• cellSaveData: PARAM.SFO is written and read as a real binary PSF, and old text saves still load (#322). UserAutoSave keeps its ninth argument (#276).
• Network:
  • from @undecuple: cellHttp's URI path (#260) and response getters (#261); sceNpBasic usable after sceNpInit (#259); sceNpCommerce2 CreateCtx (#323); the EDAT klicensee from sceNpDrmIsAvailable (#274);
  • from @tekulvw: no SIGPIPE on host sends (#250) and inet_pton (#265).
• Other:
  • from @undecuple: sys_lwcond_t layout (#277) and cellFontInitializeWithRevision (#324);
  • from @erikomis: cellGemGetMemorySize and the event-queue notify forms (#315);
  • from @tekulvw: the timezone syscall (#264), extended sysmodule tracking (#267), message-dialog abort (#251) and Sail boot parameters (#252).

Older releases: CHANGELOG.md.