LLM decompilation research
c2-rs — clean-room MSVC PowerPC compiler backend
A clean-room Rust port of the MSVC PowerPC code generator, proven byte-identical to the original DLL by a differential harness and 200-290x faster per object.
Rust · compilers · differential testing
Matching decompilation — writing original C++ that the era-correct compiler turns back into a game’s exact shipped bytes, a technique used by preservation projects to reconstruct source for classic games — puts the original compiler inside every feedback loop. For the Xbox 360’s MSVC toolchain, each invocation costs a process spawn under a Windows PE loader on Linux, topping out around 3,100 objects per second even 32-wide. When a search wants to score millions of candidates, that ceiling is the wall.
c2-rs knocks it down by porting the compiler’s back end, c2.dll, to native Rust — behaviorally, not structurally. The key insight is that cl.exe is secretly two programs with a real interface in the middle: the front end writes an intermediate-language bundle to disk, and the back end turns it into a COFF object. Porting “IL bundle in, object out” is a vastly smaller problem than porting a C++ compiler. The port’s single contract: for every IL bundle, its output must match the real DLL byte-for-byte.
The clean-room discipline is strict. The 25-year-old Microsoft DLL is treated as a black box; its object-file and IL formats were reverse-engineered purely by compiling controlled fixtures and diffing bytes, with no decompiled source anywhere in the port. The real DLL stays resident as the sole correctness judge — replayed standalone on Linux via its internal _InvokeCompilerPass export — and anything outside the port’s proven function class fails closed with NotImplemented rather than guessing. Capturing the IL at all required an undocumented flag combination that aborts compilation after the bundle is written but before the driver deletes it.
The results so far: 25/25 fixtures byte-exact for both standalone back-end and front-end replay; the native port byte-exact across its initial function class, including framed calls with unwind-data emission where being one byte wrong means being wrong; and roughly 897,000 objects per second at 32 threads versus 3,100 for the original — a 200-290x per-object speedup, measured only after the byte-exactness check passes, so the speedup is never bought with wrong bytes. The codebase is std-only Rust with zero external crates, keeping the correctness surface minimal and auditable.
The project is early and foundational — most of PowerPC codegen remains honestly NotImplemented — but the differential machinery, oracle stubs, IL codec, and corpus tooling are real, proven, and public.