Verification
milo-trace — differential verification harness
Cross-emulator dynamic tracing that replays real gameplay state against decompiled code — and an audit that found 96.7% of its own test pool had zero bug-finding power
dynamic analysis · Unicorn · equivalence checking · emulation
Decompilation projects usually verify their work with synthetic fixtures: load a function into a CPU emulator, feed it zeroed registers, and compare the output bytes. That approach is fast, but it never sees the register values and memory states that occur during real execution. milo-trace closes that gap. It instruments two game emulators (Xenia and Dolphin) plus a native port to capture per-function call records from real gameplay of two rhythm games under active preservation, then replays those records against the decompiled code to find bugs that only manifest on real inputs.
The core architectural insight is that a capture record is symmetric: its pre-state (entry registers plus the memory the function reads) is exactly a replay fixture, and its post-state (return registers and write deltas) is exactly an oracle. That contract matched an existing Unicorn-based function runner from a sibling decompilation project, so milo-trace reused that engine wholesale and spent its new code on the genuinely novel parts — JIT-level capture hooks, a frozen binary trace format shared verbatim between Python and C, and a formal trust protocol.
The hardest and most interesting result was a self-audit. An external review proved that every prior bug hunt had been tautological: 24,621 of the 25,466 functions in the hunting pool (96.7%) were byte-identical on both sides, so the differential test was comparing code to itself. Reframing the hunts around the 845 functions with actual statistical power — across 67,843 real capture records — produced the project’s first two confirmed, three-way-verified bugs: a silent no-op stub for EndianSwapEq<int> in the native port, and an arithmetic-vs-logical shift error in a random-seed routine. Both were fixed the same day. That audit also hardened into a five-check evidence-gating protocol that every bug claim must clear.
The validation gate passed cleanly at 200/200 known-equivalent functions with 100% agreement across self, oracle, and decompiled replays. Equally notable is the project’s culture of rigorously documented negative results — hunts that found nothing are reported with full reproduction paths, because a trustworthy “no bugs found” is only meaningful once you have proven your test has the power to find them.