Ghidra console-decomp fork (+ upstream NSA PR)

Ghidra is the NSA’s open-source reverse-engineering framework — a disassembler and decompiler that turns machine code back into readable pseudo-C. It handles generic PowerPC well, but the Xbox 360’s Xenon CPU adds VMX128, a proprietary 128-register SIMD extension that stock Ghidra cannot decode, and its games were built with MSVC, whose PowerPC code patterns break analyzers tuned for GCC and Clang. This fork closes both gaps, serving as the analysis backbone for a family of game-preservation and matching-decompilation projects.

The first layer is language work: full p-code semantics for all 77 VMX128 opcodes, written in Ghidra’s SLEIGH specification language and validated against 13,836 real VMX128 instructions — plus a fix to the register model itself, which had declared the 128-bit vector registers as 32-bit. The result is a new PowerPC:BE:64:Xenon processor language where vector-heavy code decompiles instead of vanishing. A second language variant covers the GameCube and Wii CPUs, with a deliberate design decision to exclude AltiVec because its encodings collide with those consoles’ paired-single instructions.

The hardest bug came from MSVC switch-statement recovery. Ghidra’s PowerPC jump-table analyzer silently failed on MSVC output for three independent reasons — an access check that always returned false, a target list that leaked between switches, and a pattern walk too shallow for MSVC’s multi-block idiom. Months later, an upstream re-sync broke the fix again via a subtler defect: a lazy symbolic-propagation fallback fired on a register’s first read, which for this pattern was the compare instruction itself, so the entire recovery path silently returned nothing. Diagnosing that inside a 17,000-commit codebase and fixing it with a precise one-line change is the war story of the project. The core analyzer fixes were filed upstream to the NSA as issue #8963 and PR #8964, with a regression test and transparent AI-assistance disclosure.

The final phase made Ghidra’s Version Tracking and BSim similarity engines survive 65,000-function binaries: a hashing fix that removed a quadratic locking stall, a parallel scoring pipeline engineered to produce identical, deterministic match sets versus the serial code, chunked processing to bound peak memory, and a candidate cap that eliminated a 70-plus-minute stall in similarity lookups. The fork ships as a public binary release and powers a downstream toolchain of binary-diffing, MCP-server, and decompilation-agent projects.