[npManager] initial Network Platform implement (just set game title etc.)

[kernel] pthread improvements
[appContent] correct way to get metadata from game
2026-07-26 04:39:17 +08:00 · 2026-06-23 19:30:27 +03:00 · 2026-06-23 19:29:29 +03:00 · 2026-06-23 19:28:53 +03:00 · 2026-06-23 19:27:57 +03:00 · 2026-06-23 19:27:24 +03:00
71 changed files with 19866 additions and 1029 deletions
@@ -0,0 +1,59 @@
+# Copyright (C) 2026 SharpEmu Emulator Project
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+name: Bug Report
+description: Report a bug in the emulator
+labels: ["bug"]
+
+body:
+  - type: markdown
+    attributes:
+      value: |
+        ### Before creating an issue
+
+        - Do not create issues involving **software piracy**. Our rules specifically prohibit this.  
+          Issues related to piracy will be closed and the author may be banned from the repository.
+
+        - The issue tracker is **not for asking questions**.  
+          Question-type issues will be closed.
+
+        - Only open an issue if you are reporting an actual **bug in the emulator**.
+
+  - type: input
+    id: emulator_version
+    attributes:
+      label: Emulator Version / Commit
+      description: The emulator version or git commit where the bug occurred
+      placeholder: e.g. v0.0.2 / a1b2c3d
+    validations:
+      required: true
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Bug Description
+      description: Describe the problem and how to reproduce it
+      placeholder: |
+        Steps to reproduce:
+        1. Launch emulator
+        2. Load game
+        3. Crash occurs
+
+        Expected behavior:
+        ...
+
+        Actual behavior:
+        ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Log File
+      description: |
+        Drag & drop your log file here, or paste the log contents.
+
+        Supported: .log / .txt / .zip
+        Large logs should be uploaded as a file.
+      render: shell
@@ -0,0 +1,4 @@
+# Copyright (C) 2026 SharpEmu Emulator Project
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+blank_issues_enabled: false
@@ -0,0 +1,144 @@
+# Copyright (C) 2026 SharpEmu Emulator Project
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+name: Game Compatibility Report
+description: Report compatibility status of a game
+labels: ["game-compatibility"]
+
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this template to report the compatibility status of a game.
+
+        Please include the **game name in the issue title**.
+
+        Example title:
+        Demon’s Souls (PPSA01341)
+
+  - type: input
+    id: game_name
+    attributes:
+      label: Game Name
+      placeholder: e.g. Demon's Souls
+    validations:
+      required: true
+
+  - type: input
+    id: title_id
+    attributes:
+      label: Title ID
+      description: Game title ID (PPSA / CUSA / PCSA etc.)
+      placeholder: e.g. PPSA01341
+    validations:
+      required: true
+
+  - type: input
+    id: game_version
+    attributes:
+      label: Game Version
+      placeholder: e.g. 1.00 / 1.09
+    validations:
+      required: true
+
+  - type: dropdown
+    id: status
+    attributes:
+      label: Current Status
+      description: What happens when running the game?
+      options:
+        - Nothing happens
+        - Crashes on boot
+        - Boots to black screen
+        - Shows intro / menus
+        - Ingame but unstable
+        - Playable
+    validations:
+      required: true
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: Describe what happens when running the game
+      placeholder: |
+        Example:
+        - Game boots
+        - Shows intro logos
+        - Crashes when entering gameplay
+    validations:
+      required: true
+
+  - type: upload
+    id: logs
+    attributes:
+      label: Log File
+      description: Drag and drop your log file here, or click to browse
+    validations:
+      required: false
+      accept: ".log,.txt,.zip"
+
+  - type: dropdown
+    id: operating_system
+    attributes:
+      label: Operating System
+      options:
+        - Windows 11
+        - Windows 10
+        - Linux
+        - macOS
+        - Other
+    validations:
+      required: true
+
+  - type: input
+    id: cpu
+    attributes:
+      label: CPU
+      placeholder: e.g. AMD Ryzen 7 5800X3D
+    validations:
+      required: true
+
+  - type: input
+    id: gpu
+    attributes:
+      label: GPU
+      placeholder: e.g. NVIDIA GeForce RTX 4070 Super
+    validations:
+      required: true
+
+  - type: input
+    id: ram
+    attributes:
+      label: RAM
+      placeholder: e.g. 32 GB
+    validations:
+      required: true
+
+  - type: input
+    id: emulator_version
+    attributes:
+      label: Emulator Version / Commit
+      placeholder: e.g. v0.0.1 / a1b2c3d
+    validations:
+      required: true
+
+  - type: dropdown
+    id: renderer
+    attributes:
+      label: Renderer
+      options:
+        - Vulkan
+        - OpenGL
+        - DirectX
+        - Software
+        - N/A
+        - Other
+    validations:
+      required: true
+
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional Notes
+      description: Screenshots, settings, patches, workarounds, or anything else relevant
@@ -1,3 +1,6 @@
+# Copyright (C) 2026 SharpEmu Emulator Project
+# SPDX-License-Identifier: GPL-2.0-or-later
+
 name: Build and Release

 on:
@@ -79,7 +82,7 @@ jobs:
      - name: Setup .NET SDK
        uses: actions/setup-dotnet@v5
        with:
-          dotnet-version: 10.0.x
+          dotnet-version: 10.0.103
          cache: true
          cache-dependency-path: |
            Directory.Packages.props
@@ -106,7 +109,7 @@ jobs:
          Compress-Archive -Path (Join-Path $env:PUBLISH_DIR '*') -DestinationPath $archivePath -CompressionLevel Optimal

      - name: Upload build artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: ${{ needs.init.outputs.artifact-name }}
          path: ${{ env.RELEASE_DIR }}\${{ needs.init.outputs.archive-name }}
@@ -123,7 +126,7 @@ jobs:
      contents: write
    steps:
      - name: Download build artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
        with:
          name: ${{ needs.init.outputs.artifact-name }}
          path: release
@@ -29,6 +29,8 @@ arm64/
 packages/
 *.nupkg
 .nuget/
+.dotnet-home/
+.cache/

 .DS_Store
 Thumbs.db
@@ -9,5 +9,8 @@ SPDX-License-Identifier: GPL-2.0-or-later
  </PropertyGroup>
  <ItemGroup>
    <PackageVersion Include="Iced" Version="1.21.0" />
+    <PackageVersion Include="Silk.NET.Vulkan" Version="2.23.0" />
+    <PackageVersion Include="Silk.NET.Vulkan.Extensions.KHR" Version="2.23.0" />
+    <PackageVersion Include="Silk.NET.Windowing" Version="2.23.0" />
  </ItemGroup>
 </Project>
@@ -3,10 +3,12 @@ version = 1
 [[annotations]]
 path = [
    "REUSE.toml",
+    "global.json",
    "**/packages.lock.json",
    "scripts/ps5_names.txt",
    "src/SharpEmu.HLE/Aerolib/aerolib.bin",
-    "_logs/**"
+    "_logs/**",
+    ".github/images/**"
 ]
 precedence = "aggregate"
 SPDX-FileCopyrightText = "SharpEmu Emulator Project"
@@ -0,0 +1,6 @@
+{
+    "sdk": {
+        "version": "10.0.103",
+        "rollForward": "disable"
+    }
+}
@@ -8,6 +8,62 @@
        "resolved": "10.0.3",
        "contentHash": "0B6nZyCHWXnvmlB559oduOspVdNOnpNXPjhpWVMovLPAsDVG7A4jJR9rzECf67JUzxP8/ee/wA8clwIzJcWNFA=="
      },
+      "Microsoft.DotNet.PlatformAbstractions": {
+        "type": "Transitive",
+        "resolved": "3.1.6",
+        "contentHash": "jek4XYaQ/PGUwDKKhwR8K47Uh1189PFzMeLqO83mXrXQVIpARZCcfuDedH50YDTepBkfijCZN5U/vZi++erxtg=="
+      },
+      "Microsoft.Extensions.DependencyModel": {
+        "type": "Transitive",
+        "resolved": "9.0.9",
+        "contentHash": "fNGvKct2De8ghm0Bpfq0iWthtzIWabgOTi+gJhNOPhNJIowXNEUE2eZNW/zNCzrHVA3PXg2yZ+3cWZndC2IqYA=="
+      },
+      "Silk.NET.Core": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "D7AT/nnwlB+4RZ84XY8QNGBZMJI5z9l4CSSETIJ1wCfRJzRt/341y3MRZ4HbnFz4r/IGaWOEZr86iE+0/65yyQ==",
+        "dependencies": {
+          "Microsoft.DotNet.PlatformAbstractions": "3.1.6",
+          "Microsoft.Extensions.DependencyModel": "9.0.9"
+        }
+      },
+      "Silk.NET.GLFW": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "UIs4sH57xlPUNHQ/1bt9rymPWlGy8IMDCNv86h0iM4TOA1CkIx0XM/n/tA4AReh1zQkNrvkxPEdZ3Blvy1dyXg==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0",
+          "Ultz.Native.GLFW": "3.4.0"
+        }
+      },
+      "Silk.NET.Maths": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "r8PdIVzME8EH0qAgbmRPO87I4GfgR2j8TofT7EMuRJDf1QluoQwnVypDoFJjQ2ZBSRsGYk5unYxxogI05Ogsmw=="
+      },
+      "Silk.NET.Windowing.Common": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "ThStSinmY9KQI8DGiF5XEhkLJVnBcgRTBTzL9ijg1wMZAYuckz7ykrNw04fjRm2Gryh6tCNGbvz2XaY0efeFzg==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0",
+          "Silk.NET.Maths": "2.23.0"
+        }
+      },
+      "Silk.NET.Windowing.Glfw": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "aYBudKmENmvLRn9p15HbdvlQTnnXskcDfTfbYwSb/4fr263rGLwYuDw/txUEc2jihHJiWCp5+75Y7z5wTJWl7g==",
+        "dependencies": {
+          "Silk.NET.GLFW": "2.23.0",
+          "Silk.NET.Windowing.Common": "2.23.0"
+        }
+      },
+      "Ultz.Native.GLFW": {
+        "type": "Transitive",
+        "resolved": "3.4.0",
+        "contentHash": "Iy22JopynbOJ32vA0lBhFEzGi65GQJBuJHYBYRBpydrDpNoTiHnjIXfA65Gu+8qsOr/ZEoIF8r9aHCgAXuO6DA=="
+      },
      "sharpemu.core": {
        "type": "Project",
        "dependencies": {
@@ -23,7 +79,10 @@
      "sharpemu.libs": {
        "type": "Project",
        "dependencies": {
-          "SharpEmu.HLE": "[1.0.0, )"
+          "SharpEmu.HLE": "[1.0.0, )",
+          "Silk.NET.Vulkan": "[2.23.0, )",
+          "Silk.NET.Vulkan.Extensions.KHR": "[2.23.0, )",
+          "Silk.NET.Windowing": "[2.23.0, )"
        }
      },
      "sharpemu.logging": {
@@ -34,10 +93,57 @@
        "requested": "[1.21.0, )",
        "resolved": "1.21.0",
        "contentHash": "dv5+81Q1TBQvVMSOOOmRcjJmvWcX3BZPZsIq31+RLc5cNft0IHAyNlkdb7ZarOWG913PyBoFDsDXoCIlKmLclg=="
+      },
+      "Silk.NET.Vulkan": {
+        "type": "CentralTransitive",
+        "requested": "[2.23.0, )",
+        "resolved": "2.23.0",
+        "contentHash": "3/irtlSWXZ3eTi8N6nelI6L34NTB8ZJHpqVMNzZx2aX7Ek9YEQ34NoQW8/Tljrtmkg8KRhHW8hKTEzZaKV8PgA==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0"
+        }
+      },
+      "Silk.NET.Vulkan.Extensions.KHR": {
+        "type": "CentralTransitive",
+        "requested": "[2.23.0, )",
+        "resolved": "2.23.0",
+        "contentHash": "uRaf4j+SmH3DumjSSSUbFg33BnsGZUyXGj93O9NgGKZSJN3OTmNmQDxRew+/KiVLcgH6qzbto8aNGZ++j9GFWg==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0",
+          "Silk.NET.Vulkan": "2.23.0"
+        }
+      },
+      "Silk.NET.Windowing": {
+        "type": "CentralTransitive",
+        "requested": "[2.23.0, )",
+        "resolved": "2.23.0",
+        "contentHash": "OPNPmt/lRyUKVYrFLQXVxyATqD3MKLc1iY1oKx1/2GppgmZxVZPwN12tekrQ4C7408kgB1L5JD1Wnirqqeb2kg==",
+        "dependencies": {
+          "Silk.NET.Windowing.Common": "2.23.0",
+          "Silk.NET.Windowing.Glfw": "2.23.0"
+        }
      }
    },
-    "net10.0/linux-x64": {},
-    "net10.0/osx-arm64": {},
-    "net10.0/win-x64": {}
+    "net10.0/linux-x64": {
+      "Ultz.Native.GLFW": {
+        "type": "Transitive",
+        "resolved": "3.4.0",
+        "contentHash": "Iy22JopynbOJ32vA0lBhFEzGi65GQJBuJHYBYRBpydrDpNoTiHnjIXfA65Gu+8qsOr/ZEoIF8r9aHCgAXuO6DA=="
+      }
+    },
+    "net10.0/osx-arm64": {
+      "Ultz.Native.GLFW": {
+        "type": "Transitive",
+        "resolved": "3.4.0",
+        "contentHash": "Iy22JopynbOJ32vA0lBhFEzGi65GQJBuJHYBYRBpydrDpNoTiHnjIXfA65Gu+8qsOr/ZEoIF8r9aHCgAXuO6DA=="
+      }
+    },
+    "net10.0/win-x64": {
+      "Ultz.Native.GLFW": {
+        "type": "Transitive",
+        "resolved": "3.4.0",
+        "contentHash": "Iy22JopynbOJ32vA0lBhFEzGi65GQJBuJHYBYRBpydrDpNoTiHnjIXfA65Gu+8qsOr/ZEoIF8r9aHCgAXuO6DA=="
+      }
+    }
  }
 }
@@ -12,10 +12,17 @@ namespace SharpEmu.Core.Cpu;

 public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
 {
+    private enum EntryFrameKind
+    {
+        ProcessEntry,
+        ModuleInitializer,
+    }
+
    private const ulong StackBaseAddress = 0x7FFF_F000_0000UL;
    private const ulong StackSize = 0x0020_0000UL;
    private const ulong TlsBaseAddress = 0x7FFE_0000_0000UL;
    private const ulong TlsSize = 0x0001_0000UL;
+    private const ulong TlsPrefixSize = 0x0000_1000UL;
    private const ulong BootstrapStubBaseAddress = 0x7FFD_F000_0000UL;
    private const ulong BootstrapPayloadBaseAddress = 0x7FFD_E000_0000UL;
    private const ulong DynlibFallbackStubBaseAddress = 0x7FFD_D000_0000UL;
@@ -88,13 +95,44 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
        }
    }

+    public OrbisGen2Result DispatchModuleInitializer(
+        ulong entryPoint,
+        Generation generation,
+        IReadOnlyDictionary<ulong, string>? importStubs = null,
+        IReadOnlyDictionary<string, ulong>? runtimeSymbols = null,
+        string moduleName = "module",
+        CpuExecutionOptions executionOptions = default)
+    {
+        Console.Error.WriteLine("[DISPATCHER] === DispatchModuleInitializer START ===");
+        Console.Error.WriteLine($"[DISPATCHER] moduleInit=0x{entryPoint:X16}, generation={generation}, module={moduleName}");
+
+        try
+        {
+            return DispatchEntryCore(
+                entryPoint,
+                generation,
+                importStubs,
+                runtimeSymbols,
+                moduleName,
+                executionOptions,
+                EntryFrameKind.ModuleInitializer);
+        }
+        catch (Exception ex)
+        {
+            Console.Error.WriteLine($"[DISPATCHER] FATAL EXCEPTION in DispatchModuleInitializer: {ex.GetType().Name}: {ex.Message}");
+            Console.Error.WriteLine($"[DISPATCHER] Stack trace: {ex.StackTrace}");
+            throw;
+        }
+    }
+
    private OrbisGen2Result DispatchEntryCore(
        ulong entryPoint,
        Generation generation,
        IReadOnlyDictionary<ulong, string>? importStubs = null,
        IReadOnlyDictionary<string, ulong>? runtimeSymbols = null,
        string processImageName = "eboot.bin",
-        CpuExecutionOptions executionOptions = default)
+        CpuExecutionOptions executionOptions = default,
+        EntryFrameKind frameKind = EntryFrameKind.ProcessEntry)
    {
        Console.Error.WriteLine("[DISPATCHER] DispatchEntryCore STARTING...");

@@ -156,6 +194,11 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
            return FailEarly(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
        }

+        if (!InitializeGuestFrameChainSentinel(context))
+        {
+            return FailEarly(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
        if (!InitializeTls(context, tlsBase))
        {
            return FailEarly(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
@@ -164,23 +207,33 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
        var effectiveImportStubs = importStubs is null
            ? new Dictionary<ulong, string>()
            : new Dictionary<ulong, string>(importStubs);
-        var programExitHandlerStubAddress = TryMapDynlibFallbackStubRegion();
-        if (programExitHandlerStubAddress == 0)
+        var entryParamsConfigured = false;
+        if (frameKind == EntryFrameKind.ProcessEntry)
        {
-            return FailEarly(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
-        }
-
-        if (!InitializeProcessEntryFrame(context, processImageName, programExitHandlerStubAddress))
-        {
-            return FailEarly(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
-        }
-
-        if (ShouldInjectBootstrapPayload(entryPoint))
-        {
-            if (!TryInstallBootstrapPayload(context, effectiveImportStubs))
+            var programExitHandlerStubAddress = TryMapDynlibFallbackStubRegion();
+            if (programExitHandlerStubAddress == 0)
            {
                return FailEarly(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
            }
+
+            if (!InitializeProcessEntryFrame(context, processImageName, programExitHandlerStubAddress))
+            {
+                return FailEarly(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+            }
+
+            entryParamsConfigured = true;
+
+            if (ShouldInjectBootstrapPayload(entryPoint))
+            {
+                if (!TryInstallBootstrapPayload(context, effectiveImportStubs))
+                {
+                    return FailEarly(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+                }
+            }
+        }
+        else if (!InitializeModuleInitializerFrame(context))
+        {
+            return FailEarly(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
        }

        var entryFrameDiagnostic = BuildEntryFrameDiagnostic(
@@ -188,7 +241,7 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
            context,
            sentinelEnabled: true,
            sentinelValue: returnToHostStubAddress,
-            entryParamsConfigured: true);
+            entryParamsConfigured: entryParamsConfigured);

        if (executionOptions.CpuEngine != CpuExecutionEngine.NativeOnly)
        {
@@ -290,11 +343,12 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
        for (var i = 0; i < 32; i++)
        {
            var candidateBase = TlsBaseAddress - ((ulong)i * tlsStride);
+            var mappedBase = candidateBase - TlsPrefixSize;
            try
            {
                _virtualMemory.Map(
-                    candidateBase,
-                    TlsSize,
+                    mappedBase,
+                    TlsSize + TlsPrefixSize,
                    fileOffset: 0,
                    fileData: ReadOnlySpan<byte>.Empty,
                    ProgramHeaderFlags.Read | ProgramHeaderFlags.Write);
@@ -311,9 +365,28 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable

    private static bool InitializeTls(CpuContext context, ulong tlsBase)
    {
-        return context.TryWriteUInt64(tlsBase + 0x00, tlsBase) &&
+        return context.TryWriteUInt64(tlsBase - 0xF0, 0) &&
+               context.TryWriteUInt64(tlsBase + 0x00, tlsBase) &&
               context.TryWriteUInt64(tlsBase + 0x10, tlsBase) &&
-               context.TryWriteUInt64(tlsBase + 0x28, 0xC0DEC0DECAFEBABEUL);
+               context.TryWriteUInt64(tlsBase + 0x28, 0xC0DEC0DECAFEBABEUL) &&
+               context.TryWriteUInt64(tlsBase + 0x60, tlsBase);
+    }
+
+    private static bool InitializeGuestFrameChainSentinel(CpuContext context)
+    {
+        var stackTop = context[CpuRegister.Rsp] + sizeof(ulong);
+        var sentinelFrame = AlignDown(stackTop - 0x20, 16);
+        var seedRsp = sentinelFrame - sizeof(ulong);
+        if (!context.TryWriteUInt64(sentinelFrame, 0) ||
+            !context.TryWriteUInt64(sentinelFrame + sizeof(ulong), 0) ||
+            !context.TryWriteUInt64(seedRsp, 0))
+        {
+            return false;
+        }
+
+        context[CpuRegister.Rbp] = sentinelFrame;
+        context[CpuRegister.Rsp] = seedRsp;
+        return true;
    }

    private static bool InitializeProcessEntryFrame(
@@ -351,6 +424,13 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
            return false;
        }

+        var entryStackPointer = entryParamsAddress - sizeof(ulong);
+        if (!context.TryWriteUInt64(entryStackPointer, 0))
+        {
+            return false;
+        }
+
+        context[CpuRegister.Rsp] = entryStackPointer;
        context[CpuRegister.Rdi] = entryParamsAddress;
        context[CpuRegister.Rsi] = programExitHandlerAddress;
        context[CpuRegister.Rdx] = 0;
@@ -360,6 +440,17 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
        return true;
    }

+    private static bool InitializeModuleInitializerFrame(CpuContext context)
+    {
+        context[CpuRegister.Rdi] = 0;
+        context[CpuRegister.Rsi] = 0;
+        context[CpuRegister.Rdx] = 0;
+        context[CpuRegister.Rcx] = 0;
+        context[CpuRegister.R8] = 0;
+        context[CpuRegister.R9] = 0;
+        return true;
+    }
+
    private static ulong AlignDown(ulong value, ulong alignment)
    {
        return value & ~(alignment - 1);
@@ -34,4 +34,12 @@ public interface ICpuDispatcher
        IReadOnlyDictionary<string, ulong>? runtimeSymbols = null,
        string processImageName = "eboot.bin",
        CpuExecutionOptions executionOptions = default);
+
+    OrbisGen2Result DispatchModuleInitializer(
+        ulong entryPoint,
+        Generation generation,
+        IReadOnlyDictionary<ulong, string>? importStubs = null,
+        IReadOnlyDictionary<string, ulong>? runtimeSymbols = null,
+        string moduleName = "module",
+        CpuExecutionOptions executionOptions = default);
 }
@@ -97,12 +97,13 @@ public sealed partial class DirectExecutionBackend

 	private void ProbeReturnRip(ulong returnRip, long dispatchIndex)
 	{
-		if (_cpuContext == null || returnRip == 0)
+		var cpuContext = ActiveCpuContext;
+		if (cpuContext == null || returnRip == 0)
 		{
 			return;
 		}
 		Span<byte> destination = stackalloc byte[128];
-		if (!_cpuContext.Memory.TryRead(returnRip, destination))
+		if (!cpuContext.Memory.TryRead(returnRip, destination))
 		{
 			Console.Error.WriteLine($"[LOADER][TRACE] Import#{dispatchIndex} return-rip probe: unreadable @0x{returnRip:X16}");
 			return;
@@ -113,7 +114,7 @@ public sealed partial class DirectExecutionBackend
 		{
 			int num = BitConverter.ToInt32(destination.Slice(2, 4));
 			ulong num2 = returnRip + 6 + (ulong)num;
-			if (_cpuContext.TryReadUInt64(num2, out var value2))
+			if (cpuContext.TryReadUInt64(num2, out var value2))
 			{
 				Console.Error.WriteLine($"[LOADER][TRACE] Import#{dispatchIndex} return-rip slot: [0x{num2:X16}] = 0x{value2:X16}");
 			}
@@ -122,7 +123,7 @@ public sealed partial class DirectExecutionBackend
 		{
 			int num3 = BitConverter.ToInt32(destination.Slice(3, 4));
 			ulong num4 = returnRip + 7 + (ulong)num3;
-			if (_cpuContext.TryReadUInt64(num4, out var value3))
+			if (cpuContext.TryReadUInt64(num4, out var value3))
 			{
 				Console.Error.WriteLine($"[LOADER][TRACE] Import#{dispatchIndex} return-rip mov-slot: [0x{num4:X16}] = 0x{value3:X16}");
 			}
@@ -134,12 +135,82 @@ public sealed partial class DirectExecutionBackend
 				int num5 = BitConverter.ToInt32(destination.Slice(i + 2, 4));
 				ulong num6 = returnRip + (ulong)i;
 				ulong num7 = num6 + 6 + (ulong)num5;
-				if (_cpuContext.TryReadUInt64(num7, out var value4))
+				if (cpuContext.TryReadUInt64(num7, out var value4))
 				{
 					Console.Error.WriteLine($"[LOADER][TRACE] Import#{dispatchIndex} near-indirect @{num6:X16}: slot=0x{num7:X16} val=0x{value4:X16}");
 				}
 			}
 		}
+		Span<byte> targetBytes = stackalloc byte[32];
+		for (int i = 0; i + 5 <= destination.Length; i++)
+		{
+			if (destination[i] != 0xE8)
+			{
+				continue;
+			}
+
+			int rel32 = BitConverter.ToInt32(destination.Slice(i + 1, 4));
+			ulong callRip = returnRip + (ulong)i;
+			ulong target = unchecked((ulong)((long)(callRip + 5) + rel32));
+			Console.Error.WriteLine($"[LOADER][TRACE] Import#{dispatchIndex} near-call @{callRip:X16}: target=0x{target:X16}");
+			for (int importIndex = 0; importIndex < _importEntries.Length; importIndex++)
+			{
+				if (_importEntries[importIndex].Address != target)
+				{
+					continue;
+				}
+
+				string nid = _importEntries[importIndex].Nid;
+				if (_moduleManager.TryGetExport(nid, out var export))
+				{
+					Console.Error.WriteLine(
+						$"[LOADER][TRACE] Import#{dispatchIndex} near-call import: index={importIndex} {export.LibraryName}:{export.Name} ({nid})");
+				}
+				else
+				{
+					Console.Error.WriteLine(
+						$"[LOADER][TRACE] Import#{dispatchIndex} near-call import: index={importIndex} nid={nid}");
+				}
+				break;
+			}
+
+			if (cpuContext.Memory.TryRead(target, targetBytes))
+			{
+				Console.Error.WriteLine(
+					$"[LOADER][TRACE] Import#{dispatchIndex} near-call target bytes @0x{target:X16}: " +
+					BitConverter.ToString(targetBytes.ToArray()).Replace("-", " "));
+				if (targetBytes[0] == 0xFF && targetBytes[1] == 0x25)
+				{
+					int slotRel32 = BitConverter.ToInt32(targetBytes.Slice(2, 4));
+					ulong slot = unchecked((ulong)((long)(target + 6) + slotRel32));
+					if (cpuContext.TryReadUInt64(slot, out var slotTarget))
+					{
+						Console.Error.WriteLine(
+							$"[LOADER][TRACE] Import#{dispatchIndex} near-call PLT slot: [0x{slot:X16}] = 0x{slotTarget:X16}");
+						for (int importIndex = 0; importIndex < _importEntries.Length; importIndex++)
+						{
+							if (_importEntries[importIndex].Address != slotTarget)
+							{
+								continue;
+							}
+
+							string nid = _importEntries[importIndex].Nid;
+							if (_moduleManager.TryGetExport(nid, out var export))
+							{
+								Console.Error.WriteLine(
+									$"[LOADER][TRACE] Import#{dispatchIndex} near-call PLT import: index={importIndex} {export.LibraryName}:{export.Name} ({nid})");
+							}
+							else
+							{
+								Console.Error.WriteLine(
+									$"[LOADER][TRACE] Import#{dispatchIndex} near-call PLT import: index={importIndex} nid={nid}");
+							}
+							break;
+						}
+					}
+				}
+			}
+		}
 	}

 	private static bool IsUnresolvedSentinel(ulong value)
@@ -4,8 +4,10 @@
 using System;
 using System.Buffers.Binary;
 using System.Collections.Generic;
+using System.Globalization;
 using System.Reflection;
 using System.Runtime.InteropServices;
+using System.Threading;
 using SharpEmu.Core.Cpu.Disasm;
 using SharpEmu.HLE;

@@ -17,7 +19,12 @@ public sealed partial class DirectExecutionBackend
 	{
 		if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_DISABLE_RAW_HANDLER"), "1", StringComparison.Ordinal))
 		{
-			_rawExceptionHandler = (nint)AddVectoredExceptionHandler(1u, RawVectoredHandlerPtrManaged);
+			_rawExceptionHandlerStub = CreateExceptionHandlerTrampoline(RawVectoredHandlerPtrManaged);
+			if (_rawExceptionHandlerStub == 0)
+			{
+				throw new InvalidOperationException("Failed to create raw exception handler trampoline");
+			}
+			_rawExceptionHandler = (nint)AddVectoredExceptionHandler(1u, _rawExceptionHandlerStub);
 			Console.Error.WriteLine($"[LOADER][INFO] Raw exception handler installed: 0x{_rawExceptionHandler:X16}");
 		}
 		else
@@ -27,12 +34,22 @@ public sealed partial class DirectExecutionBackend

 		_handlerDelegate = VectoredHandler;
 		_handlerHandle = GCHandle.Alloc(_handlerDelegate);
-		_exceptionHandler = (nint)AddVectoredExceptionHandler(1u, Marshal.GetFunctionPointerForDelegate(_handlerDelegate));
+		_exceptionHandlerStub = CreateExceptionHandlerTrampoline(Marshal.GetFunctionPointerForDelegate(_handlerDelegate));
+		if (_exceptionHandlerStub == 0)
+		{
+			throw new InvalidOperationException("Failed to create exception handler trampoline");
+		}
+		_exceptionHandler = (nint)AddVectoredExceptionHandler(1u, _exceptionHandlerStub);
 		Console.Error.WriteLine($"[LOADER][INFO] Exception handler installed: 0x{_exceptionHandler:X16}");

 		_unhandledFilterDelegate = UnhandledExceptionFilter;
 		_unhandledFilterHandle = GCHandle.Alloc(_unhandledFilterDelegate);
-		SetUnhandledExceptionFilter(Marshal.GetFunctionPointerForDelegate(_unhandledFilterDelegate));
+		_unhandledFilterStub = CreateExceptionHandlerTrampoline(Marshal.GetFunctionPointerForDelegate(_unhandledFilterDelegate));
+		if (_unhandledFilterStub == 0)
+		{
+			throw new InvalidOperationException("Failed to create unhandled exception filter trampoline");
+		}
+		SetUnhandledExceptionFilter(_unhandledFilterStub);
 	}

 	private unsafe int UnhandledExceptionFilter(void* exceptionInfo)
@@ -60,7 +77,7 @@ public sealed partial class DirectExecutionBackend
 	{
 		if (_vectoredHandlerDepth > 0)
 		{
-			Console.Error.WriteLine("[LOADER][TRACE] Nested VEH exception; passing through.");
+			LogNestedVectoredException(exceptionInfo);
 			Console.Error.Flush();
 			return 0;
 		}
@@ -83,10 +100,18 @@ public sealed partial class DirectExecutionBackend
 			ulong rip = ReadCtxU64(contextRecord, 248);
 			ulong rsp = ReadCtxU64(contextRecord, 152);

-			if (exceptionCode == 3221225477u && TryHandleLazyCommittedPage(exceptionRecord))
+			if (exceptionCode == 3221225477u && TryHandleLazyCommittedPage(exceptionRecord, rip, rsp))
 			{
 				return -1;
 			}
+			if (IsBenignHostDebugException(exceptionCode))
+			{
+				return -1;
+			}
+			if (exceptionCode == MSVC_CPP_EXCEPTION)
+			{
+				return 0;
+			}

 			switch (exceptionCode)
 			{
@@ -254,6 +279,9 @@ public sealed partial class DirectExecutionBackend
 						Console.Error.WriteLine("[LOADER][ERROR]   Could not read code at RIP");
 					}
 					DumpRecentImportTrace();
+					DumpGuestDisasmDiagnostics(rip, rbp);
+					DumpGuestReferenceDiagnostics();
+					DumpGuestPointerWindowDiagnostics();
 					break;
 				case 2147483651u:
 					Console.Error.WriteLine("[LOADER][WARNING]   Type: Breakpoint (int3)");
@@ -274,6 +302,37 @@ public sealed partial class DirectExecutionBackend
 		}
 	}

+	private static bool IsBenignHostDebugException(uint exceptionCode)
+	{
+		return exceptionCode is DBG_PRINTEXCEPTION_C or DBG_PRINTEXCEPTION_WIDE_C or MS_VC_THREADNAME_EXCEPTION;
+	}
+
+	private unsafe static void LogNestedVectoredException(void* exceptionInfo)
+	{
+		int count = Interlocked.Increment(ref _nestedVehTraceCount);
+		if (count > 16 && count % 128 != 0)
+		{
+			return;
+		}
+
+		try
+		{
+			EXCEPTION_POINTERS* pointers = (EXCEPTION_POINTERS*)exceptionInfo;
+			EXCEPTION_RECORD* record = pointers->ExceptionRecord;
+			void* contextRecord = pointers->ContextRecord;
+			ulong rip = contextRecord != null ? ReadCtxU64(contextRecord, 248) : 0;
+			ulong rsp = contextRecord != null ? ReadCtxU64(contextRecord, 152) : 0;
+			ulong accessType = record->NumberParameters >= 1 ? *record->ExceptionInformation : 0;
+			ulong target = record->NumberParameters >= 2 ? record->ExceptionInformation[1] : 0;
+			Console.Error.WriteLine(
+				$"[LOADER][TRACE] Nested VEH exception#{count}: code=0x{record->ExceptionCode:X8} ex=0x{(ulong)record->ExceptionAddress:X16} rip=0x{rip:X16} rsp=0x{rsp:X16} type={accessType} target=0x{target:X16}; passing through.");
+		}
+		catch
+		{
+			Console.Error.WriteLine($"[LOADER][TRACE] Nested VEH exception#{count}; passing through.");
+		}
+	}
+
 	private unsafe void LogAccessViolationTrace(ulong exceptionAddress, EXCEPTION_RECORD* exceptionRecord)
 	{
 		ulong accessType = exceptionRecord->NumberParameters >= 1 ? (*exceptionRecord->ExceptionInformation) : 0;
@@ -322,6 +381,239 @@ public sealed partial class DirectExecutionBackend
 		}
 	}

+	private void DumpGuestDisasmDiagnostics(ulong rip, ulong rbp)
+	{
+		if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_DISASM"), "1", StringComparison.Ordinal))
+		{
+			return;
+		}
+
+		if (rip >= 0x20)
+		{
+			DumpGuestInstructionStream("fault-prelude", rip - 0x20, 24);
+		}
+
+		try
+		{
+			ulong frame = rbp;
+			for (int i = 0; i < 3; i++)
+			{
+				if (frame < 140733193388032L || frame > 140737488355327L)
+				{
+					break;
+				}
+
+				ulong ret = (ulong)Marshal.ReadInt64((nint)(frame + 8));
+				if (ret >= 0x40)
+				{
+					DumpGuestInstructionStream($"frame#{i}-ret-prelude", ret - 0x40, 24);
+				}
+
+				ulong next = (ulong)Marshal.ReadInt64((nint)frame);
+				if (next <= frame)
+				{
+					break;
+				}
+
+				frame = next;
+			}
+		}
+		catch
+		{
+			Console.Error.WriteLine("[LOADER][WARNING]   Could not dump disasm diagnostics.");
+		}
+
+		var extraAddresses = Environment.GetEnvironmentVariable("SHARPEMU_LOG_DISASM_ADDRS");
+		if (string.IsNullOrWhiteSpace(extraAddresses))
+		{
+			return;
+		}
+
+		foreach (var token in extraAddresses.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries))
+		{
+			var normalized = token.StartsWith("0x", StringComparison.OrdinalIgnoreCase)
+				? token[2..]
+				: token;
+			if (!ulong.TryParse(normalized, NumberStyles.HexNumber, CultureInfo.InvariantCulture, out var address) || address < 0x20)
+			{
+				continue;
+			}
+
+			DumpGuestInstructionStream($"extra-0x{address:X16}", address, 48);
+		}
+	}
+
+	private unsafe void DumpGuestReferenceDiagnostics()
+	{
+		var targetList = ParseDiagnosticAddresses(Environment.GetEnvironmentVariable("SHARPEMU_LOG_REFSCAN_ADDRS"));
+		if (targetList.Count == 0 || _cpuContext == null)
+		{
+			return;
+		}
+
+		const ulong scanBase = 0x0000000800000000UL;
+		const ulong scanEnd = 0x0000000810000000UL;
+		const int maxHitsPerTarget = 24;
+
+		Console.Error.WriteLine(
+			$"[LOADER][INFO]   Ref scan targets: {string.Join(", ", targetList.ConvertAll(static addr => $"0x{addr:X16}"))}");
+
+		var hitCounts = new Dictionary<ulong, int>(targetList.Count);
+		for (var i = 0; i < targetList.Count; i++)
+		{
+			hitCounts[targetList[i]] = 0;
+		}
+
+		ulong address = scanBase;
+		while (address < scanEnd)
+		{
+			if (VirtualQuery((void*)address, out var mbi, (nuint)sizeof(MEMORY_BASIC_INFORMATION64)) == 0)
+			{
+				break;
+			}
+
+			ulong regionBase = mbi.BaseAddress;
+			ulong regionEnd = regionBase + mbi.RegionSize;
+			if (regionEnd <= address)
+			{
+				break;
+			}
+
+			if (mbi.State == MEM_COMMIT &&
+				IsReadableProtection(mbi.Protect) &&
+				IsExecutableProtection(mbi.Protect))
+			{
+				ScanExecutableRegionForTargetReferences(regionBase, regionEnd, targetList, hitCounts, maxHitsPerTarget);
+			}
+
+			var allTargetsSatisfied = true;
+			for (var i = 0; i < targetList.Count; i++)
+			{
+				if (hitCounts[targetList[i]] < maxHitsPerTarget)
+				{
+					allTargetsSatisfied = false;
+					break;
+				}
+			}
+
+			if (allTargetsSatisfied)
+			{
+				break;
+			}
+
+			address = regionEnd;
+		}
+
+		for (var i = 0; i < targetList.Count; i++)
+		{
+			var target = targetList[i];
+			if (!hitCounts.TryGetValue(target, out var count) || count == 0)
+			{
+				Console.Error.WriteLine($"[LOADER][INFO]   Ref scan 0x{target:X16}: none");
+			}
+		}
+	}
+
+	private void DumpGuestPointerWindowDiagnostics()
+	{
+		var targetList = ParseDiagnosticAddresses(Environment.GetEnvironmentVariable("SHARPEMU_LOG_POINTER_WINDOWS"));
+		if (targetList.Count == 0)
+		{
+			return;
+		}
+
+		var windowSize = 0x80;
+		var rawWindowSize = Environment.GetEnvironmentVariable("SHARPEMU_LOG_POINTER_WINDOW_SIZE");
+		if (!string.IsNullOrWhiteSpace(rawWindowSize))
+		{
+			var normalized = rawWindowSize.StartsWith("0x", StringComparison.OrdinalIgnoreCase)
+				? rawWindowSize[2..]
+				: rawWindowSize;
+			if (int.TryParse(normalized, NumberStyles.HexNumber, CultureInfo.InvariantCulture, out var parsedWindowSize) &&
+				parsedWindowSize > 0)
+			{
+				windowSize = parsedWindowSize;
+			}
+		}
+
+		foreach (var target in targetList)
+		{
+			DumpPointerWindow($"ptrwin-0x{target:X16}", target, windowSize);
+		}
+	}
+
+	private void ScanExecutableRegionForTargetReferences(
+		ulong regionBase,
+		ulong regionEnd,
+		IReadOnlyList<ulong> targets,
+		IDictionary<ulong, int> hitCounts,
+		int maxHitsPerTarget)
+	{
+		if (_cpuContext == null || regionEnd <= regionBase)
+		{
+			return;
+		}
+
+		ulong rip = regionBase;
+		while (rip < regionEnd)
+		{
+			if (!IcedDecoder.TryReadGuestBytes(_cpuContext.Memory, rip, maxLen: 15, out var bytes) ||
+				!IcedDecoder.TryDecode(rip, bytes, out var instruction) ||
+				instruction.Length <= 0)
+			{
+				rip++;
+				continue;
+			}
+
+			if (instruction.MemoryAddress is { } memoryAddress)
+			{
+				for (var i = 0; i < targets.Count; i++)
+				{
+					var target = targets[i];
+					if (memoryAddress != target ||
+						!hitCounts.TryGetValue(target, out var count) ||
+						count >= maxHitsPerTarget)
+					{
+						continue;
+					}
+
+					hitCounts[target] = count + 1;
+					Console.Error.WriteLine(
+						$"[LOADER][INFO]   Ref scan hit target=0x{target:X16} rip=0x{instruction.Rip:X16} text={instruction.Text} bytes={IcedDecoder.FormatBytes(instruction.Bytes)}");
+				}
+			}
+
+			rip += (ulong)instruction.Length;
+		}
+	}
+
+	private static List<ulong> ParseDiagnosticAddresses(string? rawValue)
+	{
+		var result = new List<ulong>();
+		if (string.IsNullOrWhiteSpace(rawValue))
+		{
+			return result;
+		}
+
+		foreach (var token in rawValue.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries))
+		{
+			var normalized = token.StartsWith("0x", StringComparison.OrdinalIgnoreCase)
+				? token[2..]
+				: token;
+			if (!ulong.TryParse(normalized, NumberStyles.HexNumber, CultureInfo.InvariantCulture, out var address))
+			{
+				continue;
+			}
+
+			if (!result.Contains(address))
+			{
+				result.Add(address);
+			}
+		}
+
+		return result;
+	}
+
 	private void DumpUnresolvedSentinelWindow(string name, ulong baseAddress, int size)
 	{
 		if (baseAddress < 0x10000 || size <= 0)
@@ -591,7 +883,7 @@ public sealed partial class DirectExecutionBackend
 		return true;
 	}

-	private unsafe static bool TryHandleLazyCommittedPage(EXCEPTION_RECORD* exceptionRecord)
+	private unsafe bool TryHandleLazyCommittedPage(EXCEPTION_RECORD* exceptionRecord, ulong rip, ulong rsp)
 	{
 		if (exceptionRecord->NumberParameters < 2)
 		{
@@ -608,6 +900,10 @@ public sealed partial class DirectExecutionBackend
 		{
 			return false;
 		}
+		if (!IsGuestOwnedLazyCommitAddress(faultAddress, out var owner))
+		{
+			return false;
+		}
 		if (VirtualQuery((void*)faultAddress, out var mbi, (nuint)sizeof(MEMORY_BASIC_INFORMATION64)) == 0)
 		{
 			return false;
@@ -615,7 +911,7 @@ public sealed partial class DirectExecutionBackend

 		ulong pageBase = faultAddress & 0xFFFFFFFFFFFFF000uL;
 		uint commitProtect = ResolveLazyCommitProtection(accessType, mbi.AllocationProtect);
-		Console.Error.WriteLine($"[LOADER][TRACE] lazy-query: fault=0x{faultAddress:X16} state=0x{mbi.State:X08} base=0x{mbi.BaseAddress:X16} size=0x{mbi.RegionSize:X16} alloc=0x{mbi.AllocationProtect:X08} prot=0x{mbi.Protect:X08}");
+		Console.Error.WriteLine($"[LOADER][TRACE] lazy-query: fault=0x{faultAddress:X16} owner={owner} rip=0x{rip:X16} rsp=0x{rsp:X16} state=0x{mbi.State:X08} base=0x{mbi.BaseAddress:X16} size=0x{mbi.RegionSize:X16} alloc=0x{mbi.AllocationProtect:X08} prot=0x{mbi.Protect:X08}");

 		bool committed = false;
 		ulong committedBase = 0;
@@ -3,6 +3,7 @@

 using System;
 using System.Collections.Generic;
+using System.Diagnostics;
 using System.Linq;
 using System.Runtime.InteropServices;
 using System.Threading;
@@ -74,7 +75,8 @@ public sealed partial class DirectExecutionBackend
 	{
 		long num = Interlocked.Increment(ref _importDispatchCount);
 		MarkExecutionProgress();
-		if (_cpuContext == null)
+		var cpuContext = ActiveCpuContext;
+		if (cpuContext == null)
 		{
 			LastError = "Import dispatch called without active CPU context";
 			return 18446744071562199298uL;
@@ -91,32 +93,32 @@ public sealed partial class DirectExecutionBackend
 			Console.Error.WriteLine($"[LOADER][TRACE] Raw sentinel recoveries: {num2} (last import index={importIndex})");
 			_lastReportedRawSentinelRecoveries = num2;
 		}
-		_cpuContext.Rip = importStubEntry.Address;
-		_cpuContext[CpuRegister.Rdi] = *(ulong*)argPackPtr;
-		_cpuContext[CpuRegister.Rsi] = *(ulong*)(argPackPtr + 8);
-		_cpuContext[CpuRegister.Rdx] = *(ulong*)(argPackPtr + 16);
-		_cpuContext[CpuRegister.Rcx] = *(ulong*)(argPackPtr + 24);
-		_cpuContext[CpuRegister.R8] = *(ulong*)(argPackPtr + 32);
-		_cpuContext[CpuRegister.R9] = *(ulong*)(argPackPtr + 40);
-		_cpuContext[CpuRegister.Rbx] = *(ulong*)(argPackPtr + 48);
-		_cpuContext[CpuRegister.Rbp] = *(ulong*)(argPackPtr + 56);
-		_cpuContext[CpuRegister.R12] = *(ulong*)(argPackPtr + 64);
-		_cpuContext[CpuRegister.R13] = *(ulong*)(argPackPtr + 72);
-		_cpuContext[CpuRegister.R14] = *(ulong*)(argPackPtr + 80);
-		_cpuContext[CpuRegister.R15] = *(ulong*)(argPackPtr + 88);
-		_cpuContext[CpuRegister.Rsp] = (ulong)argPackPtr + 96uL;
-		ulong value = _cpuContext[CpuRegister.Rdi];
-		ulong value2 = _cpuContext[CpuRegister.Rsi];
-		ulong num3 = _cpuContext[CpuRegister.Rdx];
-		ulong num4 = _cpuContext[CpuRegister.Rcx];
-		ulong num5 = _cpuContext[CpuRegister.R8];
-		ulong num6 = _cpuContext[CpuRegister.R9];
-		ulong value3 = _cpuContext[CpuRegister.Rbx];
-		ulong value4 = _cpuContext[CpuRegister.Rbp];
-		ulong value5 = _cpuContext[CpuRegister.R12];
-		ulong value6 = _cpuContext[CpuRegister.R13];
-		ulong value7 = _cpuContext[CpuRegister.R14];
-		ulong value8 = _cpuContext[CpuRegister.R15];
+		cpuContext.Rip = importStubEntry.Address;
+		cpuContext[CpuRegister.Rdi] = *(ulong*)argPackPtr;
+		cpuContext[CpuRegister.Rsi] = *(ulong*)(argPackPtr + 8);
+		cpuContext[CpuRegister.Rdx] = *(ulong*)(argPackPtr + 16);
+		cpuContext[CpuRegister.Rcx] = *(ulong*)(argPackPtr + 24);
+		cpuContext[CpuRegister.R8] = *(ulong*)(argPackPtr + 32);
+		cpuContext[CpuRegister.R9] = *(ulong*)(argPackPtr + 40);
+		cpuContext[CpuRegister.Rbx] = *(ulong*)(argPackPtr + 48);
+		cpuContext[CpuRegister.Rbp] = *(ulong*)(argPackPtr + 56);
+		cpuContext[CpuRegister.R12] = *(ulong*)(argPackPtr + 64);
+		cpuContext[CpuRegister.R13] = *(ulong*)(argPackPtr + 72);
+		cpuContext[CpuRegister.R14] = *(ulong*)(argPackPtr + 80);
+		cpuContext[CpuRegister.R15] = *(ulong*)(argPackPtr + 88);
+		cpuContext[CpuRegister.Rsp] = (ulong)argPackPtr + 96uL;
+		ulong value = cpuContext[CpuRegister.Rdi];
+		ulong value2 = cpuContext[CpuRegister.Rsi];
+		ulong num3 = cpuContext[CpuRegister.Rdx];
+		ulong num4 = cpuContext[CpuRegister.Rcx];
+		ulong num5 = cpuContext[CpuRegister.R8];
+		ulong num6 = cpuContext[CpuRegister.R9];
+		ulong value3 = cpuContext[CpuRegister.Rbx];
+		ulong value4 = cpuContext[CpuRegister.Rbp];
+		ulong value5 = cpuContext[CpuRegister.R12];
+		ulong value6 = cpuContext[CpuRegister.R13];
+		ulong value7 = cpuContext[CpuRegister.R14];
+		ulong value8 = cpuContext[CpuRegister.R15];
 		ulong num7 = *(ulong*)(argPackPtr + 96);
 		if (!IsLikelyReturnAddress(num7))
 		{
@@ -133,7 +135,16 @@ public sealed partial class DirectExecutionBackend
 			}
 		}
 		TrackDistinctImportNid(importStubEntry.Nid);
+		var probeImportReturn = Environment.GetEnvironmentVariable("SHARPEMU_PROBE_IMPORT_RET");
+		if (!string.IsNullOrWhiteSpace(probeImportReturn) &&
+			(string.Equals(probeImportReturn, "*", StringComparison.Ordinal) ||
+			 string.Equals(probeImportReturn, importStubEntry.Nid, StringComparison.Ordinal)))
+		{
+			ProbeReturnRip(num7, num);
+		}
 		TrackStrlenPrelude(importStubEntry.Nid, num, num7);
+		TraceGuestContext(
+			$"import dispatch={num} nid={importStubEntry.Nid} ret=0x{num7:X16} managed={Environment.CurrentManagedThreadId} guest=0x{GuestThreadExecution.CurrentGuestThreadHandle:X16} fiber=0x{GuestThreadExecution.CurrentFiberAddress:X16} active={HasActiveExecutionThread}");
 		bool logBootstrap = string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_BOOTSTRAP"), "1", StringComparison.Ordinal);
 		if (logBootstrap && string.Equals(importStubEntry.Nid, RuntimeStubNids.BootstrapBridge, StringComparison.Ordinal))
 		{
@@ -145,55 +156,105 @@ public sealed partial class DirectExecutionBackend
 			Console.Error.WriteLine(
 				$"[LOADER][TRACE] bootstrap_call#{num}: op=0x{value:X16} sym_ptr=0x{value2:X16} sym='{symbolText}' out_ptr=0x{num3:X16} ret=0x{num7:X16}");
 		}
-		if (!_forcedGuestExit && ShouldForceGuestExitOnImportLoop(importStubEntry.Nid, num7, num, value, value2) && TryForceGuestExitToHostStub(argPackPtr, num, num7, importStubEntry.Nid))
+		if (!ActiveForcedGuestExit && ShouldForceGuestExitOnImportLoop(importStubEntry.Nid, num7, num, value, value2) && TryForceGuestExitToHostStub(argPackPtr, num, num7, importStubEntry.Nid))
 		{
-			_cpuContext[CpuRegister.Rax] = 1uL;
+			cpuContext[CpuRegister.Rax] = 1uL;
 			return 1uL;
 		}
 		bool flag0 = ShouldSuppressStrlenTrace(importStubEntry.Nid);
 		bool flag = num7 >= 2156221920u && num7 <= 2156225024u;
 		bool flag2 = num7 >= 2156351360u && num7 <= 2156352080u;
 		bool flag3 = num >= 1020 && num <= 1040;
-		if (!flag0 && (num <= 128 || (num >= 240 && num <= 400) || (num >= 900 && num <= 1300) || num % 100000 == 0L || (importStubEntry.Nid == "tsvEmnenz48" && (num <= 256 || num % 1000 == 0L)) || (importStubEntry.Nid == "rTXw65xmLIA" && (num <= 256 || num % 128 == 0)) || flag || flag2 || flag3))
+		bool logAllImports = string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_ALL_IMPORTS"), "1", StringComparison.Ordinal);
+		string importFilter = Environment.GetEnvironmentVariable("SHARPEMU_LOG_IMPORT_FILTER");
+		bool flag4 = !string.IsNullOrWhiteSpace(importFilter);
+		bool flag5 = false;
+		ExportedFunction matchedExport = null;
+		if (_moduleManager.TryGetExport(importStubEntry.Nid, out ExportedFunction export))
 		{
-			if (_moduleManager.TryGetExport(importStubEntry.Nid, out ExportedFunction export))
+			matchedExport = export;
+			if (flag4)
 			{
-				Console.Error.WriteLine($"[LOADER][TRACE] Import#{num}: {export.LibraryName}:{export.Name} ({importStubEntry.Nid})");
+				flag5 = export.LibraryName.Contains(importFilter, StringComparison.OrdinalIgnoreCase)
+					|| export.Name.Contains(importFilter, StringComparison.OrdinalIgnoreCase)
+					|| importStubEntry.Nid.Contains(importFilter, StringComparison.OrdinalIgnoreCase);
+			}
+		}
+		else if (flag4)
+		{
+			flag5 = importStubEntry.Nid.Contains(importFilter, StringComparison.OrdinalIgnoreCase);
+		}
+		bool flag6 = logAllImports || flag5;
+		if (!flag0 && (flag6 || num <= 128 || (num >= 240 && num <= 400) || (num >= 900 && num <= 1300) || num % 100000 == 0L || (importStubEntry.Nid == "tsvEmnenz48" && (num <= 256 || num % 1000 == 0L)) || (importStubEntry.Nid == "rTXw65xmLIA" && (num <= 256 || num % 128 == 0)) || flag || flag2 || flag3))
+		{
+			if (matchedExport != null)
+			{
+				if (flag6)
+				{
+					Console.Error.WriteLine(
+						$"[LOADER][TRACE] Import#{num}: {matchedExport.LibraryName}:{matchedExport.Name} ({importStubEntry.Nid}) " +
+						$"rdi=0x{value:X16} rsi=0x{value2:X16} rdx=0x{num3:X16} rcx=0x{num4:X16} ret=0x{num7:X16}");
+				}
+				else
+				{
+					Console.Error.WriteLine($"[LOADER][TRACE] Import#{num}: {matchedExport.LibraryName}:{matchedExport.Name} ({importStubEntry.Nid})");
+				}
 			}
 			else
 			{
-				Console.Error.WriteLine($"[LOADER][TRACE] Import#{num}: {importStubEntry.Nid}");
+				if (flag6)
+				{
+					Console.Error.WriteLine(
+						$"[LOADER][TRACE] Import#{num}: {importStubEntry.Nid} " +
+						$"rdi=0x{value:X16} rsi=0x{value2:X16} rdx=0x{num3:X16} rcx=0x{num4:X16} ret=0x{num7:X16}");
+				}
+				else
+				{
+					Console.Error.WriteLine($"[LOADER][TRACE] Import#{num}: {importStubEntry.Nid}");
+				}
+			}
+			if (flag6)
+			{
+				Console.Error.Flush();
 			}
 		}
 		if (!flag0)
 		{
-			RecordRecentImportTrace($"#{num} nid={importStubEntry.Nid} ret=0x{num7:X16} rdi=0x{_cpuContext[CpuRegister.Rdi]:X16} rsi=0x{_cpuContext[CpuRegister.Rsi]:X16} rdx=0x{_cpuContext[CpuRegister.Rdx]:X16}");
+			RecordRecentImportTrace($"#{num} nid={importStubEntry.Nid} ret=0x{num7:X16} rdi=0x{cpuContext[CpuRegister.Rdi]:X16} rsi=0x{cpuContext[CpuRegister.Rsi]:X16} rdx=0x{cpuContext[CpuRegister.Rdx]:X16}");
 		}
 		if (importStubEntry.Nid == "8zTFvBIAIN8" && num <= 256)
 		{
-			Console.Error.WriteLine($"[LOADER][TRACE] memset#{num}: dst=0x{_cpuContext[CpuRegister.Rdi]:X16} val=0x{_cpuContext[CpuRegister.Rsi] & 0xFF:X2} len=0x{_cpuContext[CpuRegister.Rdx]:X16} ret=0x{num7:X16}");
+			Console.Error.WriteLine($"[LOADER][TRACE] memset#{num}: dst=0x{cpuContext[CpuRegister.Rdi]:X16} val=0x{cpuContext[CpuRegister.Rsi] & 0xFF:X2} len=0x{cpuContext[CpuRegister.Rdx]:X16} ret=0x{num7:X16}");
 		}
 		if (importStubEntry.Nid == "tsvEmnenz48" && num <= 64)
 		{
-			Console.Error.WriteLine($"[LOADER][TRACE] __cxa_atexit#{num}: func=0x{_cpuContext[CpuRegister.Rdi]:X16} arg=0x{_cpuContext[CpuRegister.Rsi]:X16} dso=0x{_cpuContext[CpuRegister.Rdx]:X16} ret=0x{num7:X16}");
+			Console.Error.WriteLine($"[LOADER][TRACE] __cxa_atexit#{num}: func=0x{cpuContext[CpuRegister.Rdi]:X16} arg=0x{cpuContext[CpuRegister.Rsi]:X16} dso=0x{cpuContext[CpuRegister.Rdx]:X16} ret=0x{num7:X16}");
 		}
 		if (importStubEntry.Nid == "bzQExy189ZI" || importStubEntry.Nid == "8G2LB+A3rzg")
 		{
-			Console.Error.WriteLine($"[LOADER][TRACE] {importStubEntry.Nid}#{num}: rdi=0x{_cpuContext[CpuRegister.Rdi]:X16} rsi=0x{_cpuContext[CpuRegister.Rsi]:X16} rdx=0x{_cpuContext[CpuRegister.Rdx]:X16} ret=0x{num7:X16}");
+			Console.Error.WriteLine($"[LOADER][TRACE] {importStubEntry.Nid}#{num}: rdi=0x{cpuContext[CpuRegister.Rdi]:X16} rsi=0x{cpuContext[CpuRegister.Rsi]:X16} rdx=0x{cpuContext[CpuRegister.Rdx]:X16} ret=0x{num7:X16}");
 		}
-		if (flag || flag2 || flag3)
+		if (flag6 || flag || flag2 || flag3)
 		{
-			Console.Error.WriteLine($"[LOADER][TRACE] ImportCtx#{num}: nid={importStubEntry.Nid} ret=0x{num7:X16} rdi=0x{_cpuContext[CpuRegister.Rdi]:X16} rsi=0x{_cpuContext[CpuRegister.Rsi]:X16} rdx=0x{_cpuContext[CpuRegister.Rdx]:X16} rcx=0x{_cpuContext[CpuRegister.Rcx]:X16}");
+			Console.Error.WriteLine($"[LOADER][TRACE] ImportCtx#{num}: nid={importStubEntry.Nid} ret=0x{num7:X16} rdi=0x{cpuContext[CpuRegister.Rdi]:X16} rsi=0x{cpuContext[CpuRegister.Rsi]:X16} rdx=0x{cpuContext[CpuRegister.Rdx]:X16} rcx=0x{cpuContext[CpuRegister.Rcx]:X16}");
 			Console.Error.WriteLine($"[LOADER][TRACE] ImportNV#{num}: rbx=0x{value3:X16} rbp=0x{value4:X16} r12=0x{value5:X16} r13=0x{value6:X16} r14=0x{value7:X16} r15=0x{value8:X16}");
 			if (flag3)
 			{
-				ulong num9 = _cpuContext[CpuRegister.Rsp];
-				if (_cpuContext.TryReadUInt64(num9, out var value9) && _cpuContext.TryReadUInt64(num9 + 8, out var value10) && _cpuContext.TryReadUInt64(num9 + 16, out var value11) && _cpuContext.TryReadUInt64(num9 + 24, out var value12) && _cpuContext.TryReadUInt64(num9 + 32, out var value13) && _cpuContext.TryReadUInt64(num9 + 40, out var value14) && _cpuContext.TryReadUInt64(num9 + 48, out var value15) && _cpuContext.TryReadUInt64(num9 + 56, out var value16) && _cpuContext.TryReadUInt64(num9 + 64, out var value17))
+				ulong num9 = cpuContext[CpuRegister.Rsp];
+				if (cpuContext.TryReadUInt64(num9, out var value9) && cpuContext.TryReadUInt64(num9 + 8, out var value10) && cpuContext.TryReadUInt64(num9 + 16, out var value11) && cpuContext.TryReadUInt64(num9 + 24, out var value12) && cpuContext.TryReadUInt64(num9 + 32, out var value13) && cpuContext.TryReadUInt64(num9 + 40, out var value14) && cpuContext.TryReadUInt64(num9 + 48, out var value15) && cpuContext.TryReadUInt64(num9 + 56, out var value16) && cpuContext.TryReadUInt64(num9 + 64, out var value17))
 				{
 					Console.Error.WriteLine($"[LOADER][TRACE] ImportStackHead#{num}: rsp=0x{num9:X16} [0]=0x{value9:X16} [20]=0x{value13:X16} [40]=0x{value17:X16}");
 					Console.Error.WriteLine($"[LOADER][TRACE] ImportStack#{num}: rsp=0x{num9:X16} [0]=0x{value9:X16} [8]=0x{value10:X16} [10]=0x{value11:X16} [18]=0x{value12:X16} [20]=0x{value13:X16} [28]=0x{value14:X16} [30]=0x{value15:X16} [38]=0x{value16:X16} [40]=0x{value17:X16}");
 				}
 			}
+			if (flag6 && string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_IMPORT_FRAMES"), "1", StringComparison.Ordinal))
+			{
+				TraceImportFrameChain(cpuContext, num);
+			}
+			if (flag6 && string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_IMPORT_RECENT"), "1", StringComparison.Ordinal))
+			{
+				DumpRecentImportTrace();
+			}
 			if (flag3)
 			{
 				Console.Error.Flush();
@@ -201,6 +262,16 @@ public sealed partial class DirectExecutionBackend
 		}
 		if (importStubEntry.Nid == "Ou3iL1abvng")
 		{
+			if (string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_STACK_CHK"), "1", StringComparison.Ordinal))
+			{
+				var savedGuardAddress = value4 >= 0x10 ? value4 - 0x10 : 0;
+				var guardKnown = TryReadUInt64Compat(value3, out var guardValue);
+				var savedKnown = TryReadUInt64Compat(savedGuardAddress, out var savedGuardValue);
+				Console.Error.WriteLine(
+					$"[LOADER][TRACE] stack_chk_diag#{num}: ret=0x{num7:X16} guard_ptr=0x{value3:X16} " +
+					$"guard={(guardKnown ? $"0x{guardValue:X16}" : "?")} saved@0x{savedGuardAddress:X16}={(savedKnown ? $"0x{savedGuardValue:X16}" : "?")} " +
+					$"rbp=0x{value4:X16} rsp=0x{((ulong)argPackPtr + 96uL):X16}");
+			}
 			try
 			{
 				byte[] array = new byte[64];
@@ -210,102 +281,138 @@ public sealed partial class DirectExecutionBackend
 			catch
 			{
 			}
-			TryBypassStackChkFailTrap(num, num7);
 		}
-		if (importStubEntry.Nid == "9rAeANT2tyE" || importStubEntry.Nid == "1j3S3n-tTW4")
-		{
-			ulong rspDbg = _cpuContext[CpuRegister.Rsp];
-			Console.Error.WriteLine(
-				$"[LOADER][TRACE] ImportDbg#{num}: nid={importStubEntry.Nid} " +
-				$"ret=0x{num7:X16} rsp=0x{rspDbg:X16} rsp&7=0x{(rspDbg & 7):X} rsp&F=0x{(rspDbg & 0xF):X}");
-
-			if (_cpuContext.TryReadUInt64(rspDbg, out var s0))
-				Console.Error.WriteLine($"[LOADER][TRACE]   [rsp+0x00] = 0x{s0:X16}");
-			if (_cpuContext.TryReadUInt64(rspDbg + 8, out var s8))
-				Console.Error.WriteLine($"[LOADER][TRACE]   [rsp+0x08] = 0x{s8:X16}");
-			if (_cpuContext.TryReadUInt64(rspDbg + 16, out var s10))
-				Console.Error.WriteLine($"[LOADER][TRACE]   [rsp+0x10] = 0x{s10:X16}");
-			if (_cpuContext.TryReadUInt64(rspDbg + 24, out var s18))
-				Console.Error.WriteLine($"[LOADER][TRACE]   [rsp+0x18] = 0x{s18:X16}");
-
-			ProbeReturnRip(num7, num);
-			Console.Error.Flush();
-		}
-		ProbeReturnRip(0x0000000800EA020Eul, 999001);
-		ProbeReturnRip(0x0000000800EA0213ul, 999002);
-		ProbeReturnRip(0x0000000800EA040Aul, 999003);
 		try
 		{
 			OrbisGen2Result orbisGen2Result;
-			if (string.Equals(importStubEntry.Nid, RuntimeStubNids.BootstrapBridge, StringComparison.Ordinal))
+			bool dispatchResolved = true;
+			var previousImportCallFrame = GuestThreadExecution.EnterImportCallFrame(
+				num7,
+				(ulong)argPackPtr + 104uL,
+				ActiveGuestReturnSlotAddress);
+			try
 			{
-				orbisGen2Result = DispatchBootstrapBridge();
+				if (string.Equals(importStubEntry.Nid, RuntimeStubNids.BootstrapBridge, StringComparison.Ordinal))
+				{
+					orbisGen2Result = DispatchBootstrapBridge();
+				}
+				else if (string.Equals(importStubEntry.Nid, RuntimeStubNids.KernelDynlibDlsym, StringComparison.Ordinal))
+				{
+					orbisGen2Result = DispatchKernelDynlibDlsym();
+				}
+				else
+				{
+					dispatchResolved = _moduleManager.TryDispatch(importStubEntry.Nid, cpuContext, out orbisGen2Result);
+				}
 			}
-			else if (string.Equals(importStubEntry.Nid, RuntimeStubNids.KernelDynlibDlsym, StringComparison.Ordinal))
+			finally
 			{
-				orbisGen2Result = DispatchKernelDynlibDlsym();
+				GuestThreadExecution.RestoreImportCallFrame(previousImportCallFrame);
 			}
-			else
+			if (dispatchResolved &&
+				orbisGen2Result == OrbisGen2Result.ORBIS_GEN2_OK &&
+				string.Equals(importStubEntry.Nid, "BohYr-F7-is", StringComparison.Ordinal))
 			{
-				orbisGen2Result = _moduleManager.Dispatch(importStubEntry.Nid, _cpuContext);
+				RegisterPrtLazyCommitRange(value2, num3);
 			}
-			switch (orbisGen2Result)
+			if (!dispatchResolved)
 			{
-				case OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND:
-					LastError = "Missing HLE export for NID: " + importStubEntry.Nid;
-					Console.Error.WriteLine($"[LOADER][WARN] Import#{num} unresolved: nid={importStubEntry.Nid} ret=0x{num7:X16}");
-					if (importStubEntry.Nid == "L-Q3LEjIbgA")
+				LastError = "Missing HLE export for NID: " + importStubEntry.Nid;
+				Console.Error.WriteLine($"[LOADER][WARN] Import#{num} unresolved: nid={importStubEntry.Nid} ret=0x{num7:X16}");
+				if (importStubEntry.Nid == "L-Q3LEjIbgA")
+				{
+					string value18 = string.Join(" ", importStubEntry.Nid.Select(delegate (char c)
 					{
-						string value18 = string.Join(" ", importStubEntry.Nid.Select(delegate (char c)
-						{
-							int num10 = c;
-							return num10.ToString("X2");
-						}));
-						Console.Error.WriteLine($"[LOADER][WARN] map_direct nid raw len={importStubEntry.Nid.Length} chars=[{value18}]");
-						Delegate function;
-						bool value19 = _moduleManager.TryGetFunction(importStubEntry.Nid, out function);
-						ExportedFunction export2;
-						bool value20 = _moduleManager.TryGetExport(importStubEntry.Nid, out export2);
-						Console.Error.WriteLine($"[LOADER][WARN] map_direct lookup with import nid: function={value19}, export={value20}");
-						Console.Error.WriteLine(_moduleManager.TryGetExport("L-Q3LEjIbgA", out ExportedFunction export3) ? $"[LOADER][WARN] Canonical map_direct exists as {export3.LibraryName}:{export3.Name}, target={export3.Target}, ctx_target={_cpuContext.TargetGeneration}" : "[LOADER][WARN] Canonical map_direct export lookup also missing");
-					}
-					break;
-				default:
-					Console.Error.WriteLine($"[LOADER][WARN] Import#{num} result: {orbisGen2Result} ({importStubEntry.Nid})");
-					break;
-				case OrbisGen2Result.ORBIS_GEN2_OK:
-					break;
+						int num10 = c;
+						return num10.ToString("X2");
+					}));
+					Console.Error.WriteLine($"[LOADER][WARN] map_direct nid raw len={importStubEntry.Nid.Length} chars=[{value18}]");
+					Delegate function;
+					bool value19 = _moduleManager.TryGetFunction(importStubEntry.Nid, out function);
+					ExportedFunction export2;
+					bool value20 = _moduleManager.TryGetExport(importStubEntry.Nid, out export2);
+					Console.Error.WriteLine($"[LOADER][WARN] map_direct lookup with import nid: function={value19}, export={value20}");
+					Console.Error.WriteLine(_moduleManager.TryGetExport("L-Q3LEjIbgA", out ExportedFunction export3) ? $"[LOADER][WARN] Canonical map_direct exists as {export3.LibraryName}:{export3.Name}, target={export3.Target}, ctx_target={cpuContext.TargetGeneration}" : "[LOADER][WARN] Canonical map_direct export lookup also missing");
+				}
+			}
+			else if (orbisGen2Result != OrbisGen2Result.ORBIS_GEN2_OK)
+			{
+				Console.Error.WriteLine(
+					$"[LOADER][WARN] Import#{num} result: {orbisGen2Result} ({importStubEntry.Nid}) " +
+					$"rdi=0x{value:X16} rsi=0x{value2:X16} rdx=0x{num3:X16} rcx=0x{num4:X16} ret=0x{num7:X16}");
+			}
+			cpuContext[CpuRegister.Rbx] = value3;
+			cpuContext[CpuRegister.Rbp] = value4;
+			cpuContext[CpuRegister.R12] = value5;
+			cpuContext[CpuRegister.R13] = value6;
+			cpuContext[CpuRegister.R14] = value7;
+			cpuContext[CpuRegister.R15] = value8;
+			cpuContext[CpuRegister.Rdi] = value;
+			cpuContext[CpuRegister.Rsi] = value2;
+			if (GuestThreadExecution.TryConsumeCurrentEntryExit(out var exitStatus, out var exitReason))
+			{
+				if (TryCompleteGuestEntryToHostStub(argPackPtr, num, num7, importStubEntry.Nid, exitReason, exitStatus))
+				{
+					cpuContext[CpuRegister.Rax] = unchecked((ulong)exitStatus);
+				}
+				else
+				{
+					LastError = $"Failed to complete guest entry after {importStubEntry.Nid}: missing host return sentinel";
+					cpuContext[CpuRegister.Rax] = 18446744071562199298uL;
+				}
+			}
+			if (GuestThreadExecution.TryConsumeCurrentThreadBlock(out var blockReason) &&
+				TryYieldGuestThreadToHostStub(argPackPtr, num, num7, importStubEntry.Nid, blockReason))
+			{
+				cpuContext[CpuRegister.Rax] = 0uL;
 			}
-			_cpuContext[CpuRegister.Rbx] = value3;
-			_cpuContext[CpuRegister.Rbp] = value4;
-			_cpuContext[CpuRegister.R12] = value5;
-			_cpuContext[CpuRegister.R13] = value6;
-			_cpuContext[CpuRegister.R14] = value7;
-			_cpuContext[CpuRegister.R15] = value8;
-			_cpuContext[CpuRegister.Rdi] = value;
-			_cpuContext[CpuRegister.Rsi] = value2;
 			if (flag || flag2 || flag3)
 			{
-				Console.Error.WriteLine($"[LOADER][TRACE] ImportRet#{num}: nid={importStubEntry.Nid} result={orbisGen2Result} rax=0x{_cpuContext[CpuRegister.Rax]:X16}");
+				Console.Error.WriteLine($"[LOADER][TRACE] ImportRet#{num}: nid={importStubEntry.Nid} result={orbisGen2Result} rax=0x{cpuContext[CpuRegister.Rax]:X16}");
 				if (flag3)
 				{
 					Console.Error.Flush();
 				}
 			}
-			return _cpuContext[CpuRegister.Rax];
+			return cpuContext[CpuRegister.Rax];
 		}
 		catch (Exception ex)
 		{
 			LastError = $"HLE dispatch error for {importStubEntry.Nid}: {ex.GetType().Name}: {ex.Message}";
-			_cpuContext[CpuRegister.Rax] = 18446744071562199298uL;
+			cpuContext[CpuRegister.Rax] = 18446744071562199298uL;
 			return 18446744071562199298uL;
 		}
 	}

+	private void TraceImportFrameChain(CpuContext context, long dispatchIndex)
+	{
+		var frame = context[CpuRegister.Rbp];
+		for (int i = 0; i < 16; i++)
+		{
+			if (!context.TryReadUInt64(frame, out var next) ||
+				!context.TryReadUInt64(frame + sizeof(ulong), out var returnRip))
+			{
+				break;
+			}
+
+			var symbol = TryFormatNearestRuntimeSymbol(returnRip, out var formatted)
+				? $" [{formatted}]"
+				: string.Empty;
+			Console.Error.WriteLine(
+				$"[LOADER][TRACE] ImportFrame#{dispatchIndex}.{i}: rbp=0x{frame:X16} ret=0x{returnRip:X16}{symbol} next=0x{next:X16}");
+			if (next <= frame || next - frame > 0x100000)
+			{
+				break;
+			}
+
+			frame = next;
+		}
+	}
+
 	private unsafe bool TryForceGuestExitToHostStub(nint argPackPtr, long dispatchIndex, ulong returnRip, string nid)
 	{
-		ulong num = _entryReturnSentinelRip;
-		if (num < 65536)
+		ulong num = ActiveEntryReturnSentinelRip;
+		if (num < 65536 || !TryPatchActiveGuestReturnSlot(num))
 		{
 			return false;
 		}
@@ -317,13 +424,64 @@ public sealed partial class DirectExecutionBackend
 		{
 			return false;
 		}
-		_forcedGuestExit = true;
+		ActiveForcedGuestExit = true;
 		LastError = $"Detected repeating import loop at import#{dispatchIndex} ({nid}) and forced guest exit.";
 		Console.Error.WriteLine($"[LOADER][ERROR] Import-loop guard fired at import#{dispatchIndex}: nid={nid} ret=0x{returnRip:X16} -> host_exit=0x{num:X16}");
 		DumpRecentImportTrace();
 		return true;
 	}

+	private unsafe bool TryCompleteGuestEntryToHostStub(nint argPackPtr, long dispatchIndex, ulong returnRip, string nid, string reason, int status)
+	{
+		ulong hostExit = ActiveEntryReturnSentinelRip;
+		if (hostExit < 65536 || !TryPatchActiveGuestReturnSlot(hostExit))
+		{
+			return false;
+		}
+		try
+		{
+			*(ulong*)(argPackPtr + 96) = hostExit;
+		}
+		catch
+		{
+			return false;
+		}
+		Console.Error.WriteLine(
+			$"[LOADER][INFO] Guest entry exit at import#{dispatchIndex}: nid={nid} ret=0x{returnRip:X16} reason={reason} status={status}");
+		return true;
+	}
+
+	private unsafe bool TryYieldGuestThreadToHostStub(nint argPackPtr, long dispatchIndex, ulong returnRip, string nid, string reason)
+	{
+		ulong hostExit = ActiveEntryReturnSentinelRip;
+		if (hostExit < 65536 || !TryPatchActiveGuestReturnSlot(hostExit))
+		{
+			return false;
+		}
+		try
+		{
+			*(ulong*)(argPackPtr + 96) = hostExit;
+		}
+		catch
+		{
+			return false;
+		}
+
+		ActiveGuestThreadYieldRequested = true;
+		ActiveGuestThreadYieldReason = string.IsNullOrWhiteSpace(reason) ? nid : reason;
+		Console.Error.WriteLine(
+			$"[LOADER][INFO] Guest thread yield at import#{dispatchIndex}: nid={nid} ret=0x{returnRip:X16} reason={ActiveGuestThreadYieldReason}");
+		return true;
+	}
+
+	private bool TryPatchActiveGuestReturnSlot(ulong hostExit)
+	{
+		ulong returnSlotAddress = ActiveGuestReturnSlotAddress;
+		return returnSlotAddress != 0 &&
+			ActiveCpuContext is not null &&
+			ActiveCpuContext.TryWriteUInt64(returnSlotAddress, hostExit);
+	}
+
 	private bool ShouldForceGuestExitOnImportLoop(string nid, ulong returnRip, long dispatchIndex, ulong arg0, ulong arg1)
 	{
 		if (dispatchIndex < 1200)
@@ -334,34 +492,77 @@ public sealed partial class DirectExecutionBackend
 		{
 			return false;
 		}
-		RecordImportLoopSignature(BuildImportLoopSignature(nid, returnRip, arg0, arg1));
+		if (IsImportLoopGuardBoundary(nid))
+		{
+			ResetImportLoopPattern();
+			return false;
+		}
+		if (!_importNidHashCache.TryGetValue(nid, out var value))
+		{
+			value = StableHash64(nid);
+			_importNidHashCache[nid] = value;
+		}
+		RecordImportLoopSignature(value, returnRip, BuildImportLoopSignature(value, returnRip, arg0, arg1));
 		if (!HasRepeatingImportLoopPattern())
 		{
 			if (_importLoopPatternHits > 0)
 			{
 				_importLoopPatternHits--;
 			}
+			if (_importLoopPatternHits == 0)
+			{
+				_importLoopPatternStartTimestamp = 0;
+			}
 			return false;
 		}
+		if (_importLoopPatternStartTimestamp == 0)
+		{
+			_importLoopPatternStartTimestamp = Stopwatch.GetTimestamp();
+		}
 		_importLoopPatternHits++;
-		return _importLoopPatternHits >= 6;
+		var guardSeconds = GetImportLoopGuardSeconds();
+		if (guardSeconds <= 0 || _importLoopPatternHits < 6)
+		{
+			return false;
+		}
+
+		var elapsedTicks = Stopwatch.GetTimestamp() - _importLoopPatternStartTimestamp;
+		return elapsedTicks >= (long)(guardSeconds * Stopwatch.Frequency);
 	}

-	private ulong BuildImportLoopSignature(string nid, ulong returnRip, ulong arg0, ulong arg1)
+	private static bool IsImportLoopGuardBoundary(string nid) =>
+		string.Equals(nid, "1jfXLRVzisc", StringComparison.Ordinal);
+
+	private void ResetImportLoopPattern()
 	{
-		if (!_importNidHashCache.TryGetValue(nid, out var value))
+		_importLoopPatternHits = 0;
+		_importLoopPatternStartTimestamp = 0;
+		_importLoopSignatureCount = 0;
+		_importLoopSignatureWriteIndex = 0;
+	}
+
+	private static int GetImportLoopGuardSeconds()
+	{
+		if (int.TryParse(Environment.GetEnvironmentVariable("SHARPEMU_IMPORT_LOOP_GUARD_SECONDS"), out var seconds))
 		{
-			value = StableHash64(nid);
-			_importNidHashCache[nid] = value;
+			return Math.Max(0, seconds);
 		}
+
+		return DefaultImportLoopGuardSeconds;
+	}
+
+	private ulong BuildImportLoopSignature(ulong nidHash, ulong returnRip, ulong arg0, ulong arg1)
+	{
 		ulong num = returnRip >> 2;
 		ulong num2 = ((arg0 >> 4) * 11400714819323198485uL) ^ ((arg1 >> 4) * 14029467366897019727uL);
-		return num ^ value * 11400714819323198485uL ^ num2;
+		return num ^ nidHash * 11400714819323198485uL ^ num2;
 	}

-	private void RecordImportLoopSignature(ulong signature)
+	private void RecordImportLoopSignature(ulong nidHash, ulong returnRip, ulong signature)
 	{
 		_importLoopSignatures[_importLoopSignatureWriteIndex] = signature;
+		_importLoopNidHashes[_importLoopSignatureWriteIndex] = nidHash;
+		_importLoopReturnRips[_importLoopSignatureWriteIndex] = returnRip;
 		_importLoopSignatureWriteIndex = (_importLoopSignatureWriteIndex + 1) % _importLoopSignatures.Length;
 		if (_importLoopSignatureCount < _importLoopSignatures.Length)
 		{
@@ -405,7 +606,7 @@ public sealed partial class DirectExecutionBackend
 				}
 			}
 		}
-		return true;
+		return IsSevereImportLoopPattern(num);
 	}

 	private ulong GetImportLoopSignatureFromTail(int offset)
@@ -418,6 +619,64 @@ public sealed partial class DirectExecutionBackend
 		return _importLoopSignatures[num % _importLoopSignatures.Length];
 	}

+	private bool IsSevereImportLoopPattern(int sampleCount)
+	{
+		int num = CountDistinctImportLoopValuesFromTail(_importLoopNidHashes, sampleCount, 3);
+		if (num > 2)
+		{
+			return false;
+		}
+		int num2 = CountDistinctImportLoopValuesFromTail(_importLoopReturnRips, sampleCount, 3);
+		if (num2 > 2)
+		{
+			return false;
+		}
+		int num3 = Math.Min(_importLoopSignatureCount, Math.Max(sampleCount * 8, ImportLoopWideDiversityWindow));
+		if (num3 <= sampleCount)
+		{
+			return true;
+		}
+		if (CountDistinctImportLoopValuesFromTail(_importLoopNidHashes, num3, 3) > 2)
+		{
+			return false;
+		}
+		return CountDistinctImportLoopValuesFromTail(_importLoopReturnRips, num3, 3) <= 2;
+	}
+
+	private int CountDistinctImportLoopValuesFromTail(ulong[] source, int sampleCount, int stopAfter)
+	{
+		int num = Math.Min(sampleCount, _importLoopSignatureCount);
+		int num2 = 0;
+		for (int i = 0; i < num; i++)
+		{
+			ulong importLoopValueFromTail = GetImportLoopValueFromTail(source, i);
+			bool flag = false;
+			for (int j = 0; j < i; j++)
+			{
+				if (GetImportLoopValueFromTail(source, j) == importLoopValueFromTail)
+				{
+					flag = true;
+					break;
+				}
+			}
+			if (!flag && ++num2 >= stopAfter)
+			{
+				return num2;
+			}
+		}
+		return num2;
+	}
+
+	private ulong GetImportLoopValueFromTail(ulong[] source, int offset)
+	{
+		int num = _importLoopSignatureWriteIndex - 1 - offset;
+		while (num < 0)
+		{
+			num += source.Length;
+		}
+		return source[num % source.Length];
+	}
+
 	private bool ShouldSuppressStrlenTrace(string nid)
 	{
 		return string.Equals(nid, "j4ViWNHEgww", StringComparison.Ordinal) && !_logStrlenImports;
@@ -507,41 +766,43 @@ public sealed partial class DirectExecutionBackend

 	private OrbisGen2Result DispatchKernelDynlibDlsym()
 	{
-		if (_cpuContext == null)
+		var cpuContext = ActiveCpuContext;
+		if (cpuContext == null)
 		{
 			return OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
 		}
-		ulong symbolNameAddress = _cpuContext[CpuRegister.Rsi];
-		ulong outputAddress = _cpuContext[CpuRegister.Rdx];
+		ulong symbolNameAddress = cpuContext[CpuRegister.Rsi];
+		ulong outputAddress = cpuContext[CpuRegister.Rdx];
 		if (!TryReadAsciiZ(symbolNameAddress, 512, out var symbolName))
 		{
-			_cpuContext[CpuRegister.Rax] = 18446744073709551615uL;
+			cpuContext[CpuRegister.Rax] = 18446744073709551615uL;
 			return OrbisGen2Result.ORBIS_GEN2_OK;
 		}
 		if (!TryResolveRuntimeSymbolAddress(symbolName, out var resolvedAddress))
 		{
-			_cpuContext[CpuRegister.Rax] = 18446744073709551615uL;
+			cpuContext[CpuRegister.Rax] = 18446744073709551615uL;
 			return OrbisGen2Result.ORBIS_GEN2_OK;
 		}
 		if (outputAddress == 0L || !TryWriteUInt64Compat(outputAddress, resolvedAddress))
 		{
-			_cpuContext[CpuRegister.Rax] = 18446744073709551615uL;
+			cpuContext[CpuRegister.Rax] = 18446744073709551615uL;
 			return OrbisGen2Result.ORBIS_GEN2_OK;
 		}
-		_cpuContext[CpuRegister.Rax] = 0uL;
+		cpuContext[CpuRegister.Rax] = 0uL;
 		return OrbisGen2Result.ORBIS_GEN2_OK;
 	}

 	private OrbisGen2Result DispatchBootstrapBridge()
 	{
-		if (_cpuContext == null)
+		var cpuContext = ActiveCpuContext;
+		if (cpuContext == null)
 		{
 			return OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
 		}

-		ulong bridgeHandle = _cpuContext[CpuRegister.Rdi];
-		ulong symbolNameAddress = _cpuContext[CpuRegister.Rsi];
-		ulong outputAddress = _cpuContext[CpuRegister.Rdx];
+		ulong bridgeHandle = cpuContext[CpuRegister.Rdi];
+		ulong symbolNameAddress = cpuContext[CpuRegister.Rsi];
+		ulong outputAddress = cpuContext[CpuRegister.Rdx];
 		_ = TryReadAsciiZ(symbolNameAddress, 512, out var symbolName);

 		OrbisGen2Result result = DispatchKernelDynlibDlsym();
@@ -553,10 +814,10 @@ public sealed partial class DirectExecutionBackend
 		if (logBootstrap)
 		{
 			Console.Error.WriteLine(
-				$"[LOADER][TRACE] bootstrap_dispatch: handle=0x{bridgeHandle:X16} symbol='{symbolName}' out=0x{outputAddress:X16} rax=0x{_cpuContext[CpuRegister.Rax]:X16}");
+				$"[LOADER][TRACE] bootstrap_dispatch: handle=0x{bridgeHandle:X16} symbol='{symbolName}' out=0x{outputAddress:X16} rax=0x{cpuContext[CpuRegister.Rax]:X16}");
 		}

-		if (_cpuContext[CpuRegister.Rax] == 0uL)
+		if (cpuContext[CpuRegister.Rax] == 0uL)
 		{
 			return OrbisGen2Result.ORBIS_GEN2_OK;
 		}
@@ -599,7 +860,7 @@ public sealed partial class DirectExecutionBackend
 	private bool TryReadAsciiZ(ulong address, int maxLength, out string value)
 	{
 		value = string.Empty;
-		if (_cpuContext == null || address == 0L || maxLength <= 0)
+		if (ActiveCpuContext == null || address == 0L || maxLength <= 0)
 		{
 			return false;
 		}
@@ -624,11 +885,12 @@ public sealed partial class DirectExecutionBackend

 	private bool TryReadByteCompat(ulong address, Span<byte> destination)
 	{
-		if (_cpuContext == null || destination.Length == 0)
+		var cpuContext = ActiveCpuContext;
+		if (cpuContext == null || destination.Length == 0)
 		{
 			return false;
 		}
-		if (_cpuContext.Memory.TryRead(address, destination))
+		if (cpuContext.Memory.TryRead(address, destination))
 		{
 			return true;
 		}
@@ -643,13 +905,38 @@ public sealed partial class DirectExecutionBackend
 		}
 	}

-	private bool TryWriteUInt64Compat(ulong address, ulong value)
+	private bool TryReadUInt64Compat(ulong address, out ulong value)
 	{
-		if (_cpuContext == null || address == 0L)
+		value = 0;
+		var cpuContext = ActiveCpuContext;
+		if (cpuContext == null || address == 0L)
 		{
 			return false;
 		}
-		if (_cpuContext.TryWriteUInt64(address, value))
+		if (cpuContext.TryReadUInt64(address, out value))
+		{
+			return true;
+		}
+		try
+		{
+			value = unchecked((ulong)Marshal.ReadInt64((nint)address));
+			return true;
+		}
+		catch
+		{
+			value = 0;
+			return false;
+		}
+	}
+
+	private bool TryWriteUInt64Compat(ulong address, ulong value)
+	{
+		var cpuContext = ActiveCpuContext;
+		if (cpuContext == null || address == 0L)
+		{
+			return false;
+		}
+		if (cpuContext.TryWriteUInt64(address, value))
 		{
 			return true;
 		}
@@ -664,65 +951,6 @@ public sealed partial class DirectExecutionBackend
 		}
 	}

-	private void TryBypassStackChkFailTrap(long dispatchIndex, ulong returnRip)
-	{
-		if (_cpuContext == null || returnRip < 32)
-		{
-			return;
-		}
-		try
-		{
-			byte[] array = new byte[19];
-			ulong num = returnRip - 23;
-			Marshal.Copy((nint)num, array, 0, array.Length);
-			if (array[0] != 117 || array[1] != 16 || array[2] != 72 || array[3] != 137 || array[4] != 216 || array[5] != 72 || array[6] != 131 || array[7] != 196 || array[9] != 91 || array[10] != 65 || array[11] != 92 || array[12] != 65 || array[13] != 94 || array[14] != 65 || array[15] != 95 || array[16] != 93 || array[17] != 195 || array[18] != 232)
-			{
-				return;
-			}
-			ulong value = returnRip - 21;
-			ulong address = _cpuContext[CpuRegister.Rsp];
-			if (_cpuContext.TryWriteUInt64(address, value))
-			{
-				if (_stackChkBypassSites.Add(num) && TryPatchStackChkFailBranch(num))
-				{
-					Console.Error.WriteLine($"[LOADER][WARNING] Import#{dispatchIndex}: patched stack_chk_fail tail branch at 0x{num:X16} -> NOP NOP");
-				}
-				Console.Error.WriteLine($"[LOADER][WARNING] Import#{dispatchIndex}: redirected __stack_chk_fail return to epilogue 0x{value:X16}");
-			}
-		}
-		catch
-		{
-		}
-	}
-
-	private unsafe static bool TryPatchStackChkFailBranch(ulong branchAddress)
-	{
-		uint flNewProtect = default(uint);
-		if (!VirtualProtect((void*)branchAddress, 2u, 64u, &flNewProtect))
-		{
-			return false;
-		}
-		try
-		{
-			if (Marshal.ReadByte((nint)branchAddress) != 117)
-			{
-				return false;
-			}
-			Marshal.WriteByte((nint)branchAddress, 144);
-			Marshal.WriteByte((nint)(branchAddress + 1), 144);
-			FlushInstructionCache(GetCurrentProcess(), (void*)branchAddress, 2u);
-			return true;
-		}
-		catch
-		{
-			return false;
-		}
-		finally
-		{
-			VirtualProtect((void*)branchAddress, 2u, flNewProtect, &flNewProtect);
-		}
-	}
-
 	private unsafe void TryPatchEa020eLookupCall(long dispatchIndex, ulong returnRip)
 	{
 		if (_patchedEa020eLookupCall || returnRip != 0x0000000800EA01A6uL)
@@ -5,7 +5,7 @@ using SharpEmu.HLE;

 namespace SharpEmu.Core.Cpu;

-public sealed class TrackedCpuMemory : ICpuMemory, ITrackedCpuMemory
+public sealed class TrackedCpuMemory : ICpuMemory, ITrackedCpuMemory, IGuestMemoryAllocator
 {
    private readonly ICpuMemory _inner;

@@ -39,4 +39,15 @@ public sealed class TrackedCpuMemory : ICpuMemory, ITrackedCpuMemory

        return result;
    }
+
+    public bool TryAllocateGuestMemory(ulong size, ulong alignment, out ulong address)
+    {
+        if (_inner is IGuestMemoryAllocator allocator)
+        {
+            return allocator.TryAllocateGuestMemory(size, alignment, out address);
+        }
+
+        address = 0;
+        return false;
+    }
 }
@@ -0,0 +1,10 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.Core.Loader;
+
+public readonly record struct ImportedSymbolRelocation(
+    ulong TargetAddress,
+    long Addend,
+    string Nid,
+    bool IsData);
@@ -16,8 +16,15 @@ public sealed class SelfImage
        IReadOnlyList<VirtualMemoryRegion> mappedRegions,
        IReadOnlyDictionary<ulong, string>? importStubs = null,
        IReadOnlyDictionary<string, ulong>? runtimeSymbols = null,
+        IReadOnlyList<ImportedSymbolRelocation>? importedRelocations = null,
+        IReadOnlyList<ulong>? preInitializerFunctions = null,
+        IReadOnlyList<ulong>? initializerFunctions = null,
+        ulong initFunctionEntryPoint = 0,
        ulong imageBase = 0,
-        ulong procParamAddress = 0)
+        ulong procParamAddress = 0,
+        string? title = null,
+        string? titleId = null,
+        string? version = null)
    {
        ArgumentNullException.ThrowIfNull(programHeaders);
        ArgumentNullException.ThrowIfNull(mappedRegions);
@@ -28,8 +35,15 @@ public sealed class SelfImage
        MappedRegions = mappedRegions;
        ImportStubs = importStubs ?? new Dictionary<ulong, string>();
        RuntimeSymbols = runtimeSymbols ?? new Dictionary<string, ulong>(StringComparer.Ordinal);
+        ImportedRelocations = importedRelocations ?? Array.Empty<ImportedSymbolRelocation>();
+        PreInitializerFunctions = preInitializerFunctions ?? Array.Empty<ulong>();
+        InitializerFunctions = initializerFunctions ?? Array.Empty<ulong>();
+        InitFunctionEntryPoint = initFunctionEntryPoint;
        _imageBase = imageBase;
        ProcParamAddress = procParamAddress;
+        Title = title;
+        TitleId = titleId;
+        Version = version;
    }

    public bool IsSelf { get; }
@@ -44,7 +58,21 @@ public sealed class SelfImage

    public IReadOnlyDictionary<string, ulong> RuntimeSymbols { get; }

+    public IReadOnlyList<ImportedSymbolRelocation> ImportedRelocations { get; }
+
+    public IReadOnlyList<ulong> PreInitializerFunctions { get; }
+
+    public IReadOnlyList<ulong> InitializerFunctions { get; }
+
+    public ulong InitFunctionEntryPoint { get; }
+
    public ulong EntryPoint => ElfHeader.EntryPoint + _imageBase;

    public ulong ProcParamAddress { get; }
+
+    public string? Title { get; }
+
+    public string? TitleId { get; }
+
+    public string? Version { get; }
 }
@@ -29,6 +29,7 @@ public sealed class SelfLoader : ISelfLoader
    private const int ElfRelocationSize = 24;
    private const int ElfSectionHeaderSize = 64;
    private const uint SectionTypeSymbolTable = 2;
+    private const uint SectionTypeRela = 4;

    private const long DtNull = 0;
    private const long DtPltRelSize = 0x02;
@@ -37,8 +38,13 @@ public sealed class SelfLoader : ISelfLoader
    private const long DtSymTab = 0x06;
    private const long DtRela = 0x07;
    private const long DtRelaSize = 0x08;
+    private const long DtInit = 0x0C;
    private const long DtStrSize = 0x0A;
    private const long DtJmpRel = 0x17;
+    private const long DtInitArray = 0x19;
+    private const long DtInitArraySize = 0x1B;
+    private const long DtPreInitArray = 0x20;
+    private const long DtPreInitArraySize = 0x21;
    private const long DtSceJmpRel = 0x61000029;
    private const long DtScePltRelSize = 0x6100002D;
    private const long DtSceRela = 0x6100002F;
@@ -60,11 +66,12 @@ public sealed class SelfLoader : ISelfLoader
    private const ulong Ps4ModuleSearchStart = 0x0000000002000000UL;
    private const ulong Ps4ModuleSearchEnd = 0x0000000040000000UL;
    private const ulong ModulePlacementStep = 0x00200000UL;
-    private const ulong FocusRelocGuestStart = 0x00000008030FC300UL;
-    private const ulong FocusRelocGuestEnd = 0x00000008030FC3F0UL;
+    private const ulong FocusRelocGuestStart = 0x0000000807BA25B0UL;
+    private const ulong FocusRelocGuestEnd = 0x0000000807BA2608UL;
    private const byte SymbolBindLocal = 0;
    private const byte SymbolBindGlobal = 1;
    private const byte SymbolBindWeak = 2;
+    private const byte SymbolTypeObject = 1;

    private IModuleManager? _moduleManager;
    private uint _nextTlsModuleId = 1;
@@ -72,6 +79,7 @@ public sealed class SelfLoader : ISelfLoader
    private static readonly IReadOnlyDictionary<ulong, string> EmptyImportStubs = new Dictionary<ulong, string>();
    private static readonly IReadOnlyDictionary<string, ulong> EmptyRuntimeSymbols =
        new Dictionary<string, ulong>(StringComparer.Ordinal);
+    private static readonly IReadOnlyList<ulong> EmptyInitializerFunctions = Array.Empty<ulong>();
    private static readonly int SelfHeaderSize = Unsafe.SizeOf<SelfHeader>();
    private static readonly int SelfSegmentSize = Unsafe.SizeOf<SelfSegment>();
    private static readonly int ProgramHeaderSize = Unsafe.SizeOf<ProgramHeader>();
@@ -136,10 +144,9 @@ public sealed class SelfLoader : ISelfLoader
            throw new InvalidDataException("Input image is empty.");
        }

-        if (readParamJson)
-        {
-            TryLoadParamJson(fs, mountRoot);
-        }
+        var applicationInfo = readParamJson
+            ? TryLoadParamJson(fs, mountRoot)
+            : default;

        if (clearVirtualMemory)
        {
@@ -190,11 +197,13 @@ public sealed class SelfLoader : ISelfLoader
        var importStubs = ResolveAndPatchImportStubs(
            imageData,
            loadContext,
+            elfHeader,
            programHeaders,
            virtualMemory,
            imageBase,
            _moduleManager,
-            tlsModuleId);
+            tlsModuleId,
+            out var importedRelocations);
        var effectiveImportStubs = importStubs.Count == 0
            ? new Dictionary<ulong, string>()
            : new Dictionary<ulong, string>(importStubs);
@@ -214,6 +223,15 @@ public sealed class SelfLoader : ISelfLoader
        var finalizedRuntimeSymbols = runtimeSymbols.Count == 0
            ? EmptyRuntimeSymbols
            : runtimeSymbols;
+        CollectInitializerFunctions(
+            imageData,
+            loadContext,
+            programHeaders,
+            virtualMemory,
+            imageBase,
+            out var initFunctionEntryPoint,
+            out var preInitializerFunctions,
+            out var initializerFunctions);
        var procParamAddress = ResolveProcParamAddress(programHeaders, imageBase);

        Console.WriteLine($"[LOADER] ELF e_entry: 0x{elfHeader.EntryPoint:X16}");
@@ -246,16 +264,25 @@ public sealed class SelfLoader : ISelfLoader
            virtualMemory.SnapshotRegions(),
            finalizedImportStubs,
            finalizedRuntimeSymbols,
+            importedRelocations,
+            preInitializerFunctions,
+            initializerFunctions,
+            initFunctionEntryPoint,
            imageBase,
-            procParamAddress);
+            procParamAddress,
+            applicationInfo.Title,
+            applicationInfo.TitleId,
+            applicationInfo.Version);
    }

-    private static void TryLoadParamJson(IFileSystem? fs, string? mountRoot)
+    private static (string? Title, string? TitleId, string? Version) TryLoadParamJson(
+        IFileSystem? fs,
+        string? mountRoot)
    {
        if (fs == null)
        {
            Console.WriteLine("[LOADER] param.json not found (no filesystem provided).");
-            return;
+            return default;
        }

        string[] possiblePaths = string.IsNullOrEmpty(mountRoot)
@@ -275,12 +302,16 @@ public sealed class SelfLoader : ISelfLoader
        if (foundPath == null)
        {
            Console.WriteLine("[LOADER] param.json not found (no root path / unknown layout).");
-            return;
+            return default;
        }

-        var (title, titleId, ver) = Ps5ParamJsonReader.TryReadPs5Param(fs, foundPath);
+        var applicationInfo = Ps5ParamJsonReader.TryReadPs5Param(fs, foundPath);
        Console.WriteLine($"[LOADER] Loading param.json at {foundPath}");
-        Console.WriteLine($"[LOADER] Title: {title ?? "(unknown)"}, TitleId: {titleId ?? "(unknown)"}, Version: {ver ?? "(unknown)"}");
+        Console.WriteLine(
+            $"[LOADER] Title: {applicationInfo.Title ?? "(unknown)"}, " +
+            $"TitleId: {applicationInfo.TitleId ?? "(unknown)"}, " +
+            $"Version: {applicationInfo.Version ?? "(unknown)"}");
+        return applicationInfo;
    }

    private static LoadContext ParseLayout(ReadOnlySpan<byte> imageData)
@@ -426,12 +457,15 @@ public sealed class SelfLoader : ISelfLoader
    private static IReadOnlyDictionary<ulong, string> ResolveAndPatchImportStubs(
        ReadOnlySpan<byte> imageData,
        LoadContext loadContext,
+        ElfHeader elfHeader,
        IReadOnlyList<ProgramHeader> programHeaders,
        IVirtualMemory virtualMemory,
        ulong imageBase,
        IModuleManager? moduleManager,
-        uint tlsModuleId)
+        uint tlsModuleId,
+        out IReadOnlyList<ImportedSymbolRelocation> importedRelocations)
    {
+        importedRelocations = Array.Empty<ImportedSymbolRelocation>();
        if (!TryGetProgramHeader(programHeaders, ProgramHeaderType.Dynamic, out var dynamicHeader, out var dynamicHeaderIndex))
        {
            return EmptyImportStubs;
@@ -447,10 +481,18 @@ public sealed class SelfLoader : ISelfLoader
            throw new NotSupportedException("Dynamic metadata segments larger than 2 GB are not currently supported.");
        }

-        var dynamicOffset = ResolvePhysicalSegmentOffset(imageData.Length, loadContext, dynamicHeader, dynamicHeaderIndex);
-        EnsureRange(imageData.Length, dynamicOffset, dynamicHeader.FileSize);
+        if (!TryLoadDynamicTableBytes(
+                imageData,
+                loadContext,
+                virtualMemory,
+                imageBase,
+                dynamicHeader,
+                dynamicHeaderIndex,
+                out var dynamicTable))
+        {
+            return EmptyImportStubs;
+        }

-        var dynamicTable = imageData.Slice((int)dynamicOffset, (int)dynamicHeader.FileSize);
        var elfData = imageData;

        var dynamicInfo = ParseDynamicInfo(dynamicTable);
@@ -463,13 +505,6 @@ public sealed class SelfLoader : ISelfLoader
        Console.WriteLine($"[LOADER] TLS module id: {tlsModuleId}");
        Console.WriteLine($"[LOADER] HasImportMetadata: {dynamicInfo.HasImportMetadata}");

-        if (!dynamicInfo.HasImportMetadata)
-        {
-            Console.WriteLine($"[LOADER] No import metadata found in ELF!");
-            return EmptyImportStubs;
-        }
-
-        Console.WriteLine($"[LOADER] ImageBase runtime: 0x{imageBase:X16}");
        var relocations = new List<ElfRelocation>(512);

        if (dynamicInfo.RelaSize != 0 &&
@@ -484,13 +519,16 @@ public sealed class SelfLoader : ISelfLoader
            CollectRelocations(jmpRelBytes, relocations);
        }

-        if (relocations.Count == 0)
+        if (!dynamicInfo.HasImportMetadata)
        {
-            Console.WriteLine($"[LOADER] No relocations found!");
-            return EmptyImportStubs;
+            Console.WriteLine($"[LOADER] No import metadata found in ELF!");
        }

-        Console.WriteLine($"[LOADER] Processing {relocations.Count} relocations...");
+        if (relocations.Count != 0)
+        {
+            Console.WriteLine($"[LOADER] ImageBase runtime: 0x{imageBase:X16}");
+            Console.WriteLine($"[LOADER] Processing {relocations.Count} relocations...");
+        }

        uint maxSymbolIndex = 0;
        foreach (var relocation in relocations)
@@ -544,164 +582,37 @@ public sealed class SelfLoader : ISelfLoader
        var descriptors = new List<RelocationDescriptor>(256);
        var orderedImportNids = new List<string>(128);
        var seenImportNids = new HashSet<string>(StringComparer.Ordinal);
-        var skippedUnsupported = 0;
-        var skippedUnmapped = 0;
-        var skippedSymbolRead = 0;
-        var skippedNonImportBind = 0;
-        var skippedNameRead = 0;
-        var skippedEmptyNid = 0;
-        foreach (var relocation in relocations)
+        AppendRelocationDescriptors(
+            relocations,
+            symbolTable,
+            stringTable,
+            virtualMemory,
+            imageBase,
+            tlsModuleId,
+            descriptors,
+            orderedImportNids,
+            seenImportNids);
+
+        if (descriptors.Count == 0)
        {
-            if (IsFocusRelocationOffset(relocation.Offset, imageBase))
+            var sectionFallbackRelocCount = AppendSectionRelocationDescriptors(
+                imageData,
+                loadContext,
+                elfHeader,
+                virtualMemory,
+                imageBase,
+                tlsModuleId,
+                descriptors,
+                orderedImportNids,
+                seenImportNids);
+            if (sectionFallbackRelocCount != 0)
            {
-                Console.Error.WriteLine(
-                    $"[LOADER][FOCUS][SCAN] off=0x{relocation.Offset:X16} type={relocation.Type} sym={relocation.SymbolIndex} addend=0x{relocation.Addend:X}");
+                Console.WriteLine(
+                    $"[LOADER] Section relocation fallback recovered {sectionFallbackRelocCount} relocation entries, {orderedImportNids.Count} unique NIDs, {descriptors.Count} descriptors");
            }
-
-            if (!IsSupportedRelocationType(relocation.Type))
-            {
-                skippedUnsupported++;
-                if (IsFocusRelocationOffset(relocation.Offset, imageBase))
-                {
-                    Console.Error.WriteLine($"[LOADER][FOCUS][SKIP] unsupported type={relocation.Type}");
-                }
-                continue;
-            }
-
-            if (!TryResolveMappedAddress(virtualMemory, relocation.Offset, imageBase, sizeof(ulong), out var targetAddress))
-            {
-                skippedUnmapped++;
-                if (IsFocusRelocationOffset(relocation.Offset, imageBase))
-                {
-                    Console.Error.WriteLine("[LOADER][FOCUS][SKIP] target address not mapped");
-                }
-                continue;
-            }
-
-            if (relocation.Type == RelocationTypeRelative)
-            {
-                descriptors.Add(new RelocationDescriptor(
-                    targetAddress,
-                    relocation.Addend,
-                    null,
-                    imageBase,
-                    RelocationValueKind.Pointer));
-                continue;
-            }
-
-            if (relocation.Type == RelocationTypeTlsModuleId)
-            {
-                var dtpmodValue = tlsModuleId == 0 ? 1u : tlsModuleId;
-                descriptors.Add(new RelocationDescriptor(
-                    targetAddress,
-                    0,
-                    null,
-                    dtpmodValue,
-                    RelocationValueKind.TlsModuleId));
-                continue;
-            }
-
-            var symbolIndex = relocation.SymbolIndex;
-            ElfSymbol symbol;
-            if (symbolIndex == 0)
-            {
-                symbol = default;
-            }
-            else if (!TryReadSymbol(symbolTable, symbolIndex, out symbol))
-            {
-                skippedSymbolRead++;
-                if (targetAddress >= FocusRelocGuestStart && targetAddress <= FocusRelocGuestEnd)
-                {
-                    Console.Error.WriteLine($"[LOADER][FOCUS][SKIP] symbol read failed index={symbolIndex}");
-                }
-                continue;
-            }
-
-            var addend = relocation.Type is RelocationTypeGlobalData or RelocationTypeJumpSlot ? 0 : relocation.Addend;
-            var symbolBind = GetSymbolBind(symbol.Info);
-            if (symbolBind == SymbolBindLocal)
-            {
-                var symbolAddress = ResolveMappedAddressOrFallback(virtualMemory, symbol.Value, imageBase);
-                if (symbolAddress == 0)
-                {
-                    Console.Error.WriteLine(
-                        $"[LOADER] Skipping local relocation with invalid symbol value 0x{symbol.Value:X} " +
-                        $"at target 0x{targetAddress:X16}, type={relocation.Type}, sym={symbolIndex}");
-                    continue;
-                }
-
-                descriptors.Add(new RelocationDescriptor(
-                    targetAddress,
-                    addend,
-                    null,
-                    symbolAddress,
-                    RelocationValueKind.Pointer));
-                continue;
-            }
-
-            if (symbol.Value != 0)
-            {
-                var symbolAddress = ResolveMappedAddressOrFallback(virtualMemory, symbol.Value, imageBase);
-                if (symbolAddress == 0)
-                {
-                    Console.Error.WriteLine(
-                        $"[LOADER] Skipping relocation with invalid symbol value 0x{symbol.Value:X} " +
-                        $"at target 0x{targetAddress:X16}, type={relocation.Type}, sym={symbolIndex}");
-                    continue;
-                }
-
-                descriptors.Add(new RelocationDescriptor(
-                    targetAddress,
-                    addend,
-                    null,
-                    symbolAddress,
-                    RelocationValueKind.Pointer));
-                continue;
-            }
-
-            if (symbolBind is not (SymbolBindGlobal or SymbolBindWeak))
-            {
-                skippedNonImportBind++;
-                if (targetAddress >= FocusRelocGuestStart && targetAddress <= FocusRelocGuestEnd)
-                {
-                    Console.Error.WriteLine($"[LOADER][FOCUS][SKIP] bind={symbolBind} not importable");
-                }
-                continue;
-            }
-
-            if (!TryReadNullTerminatedAscii(stringTable, symbol.NameOffset, out var symbolName))
-            {
-                skippedNameRead++;
-                if (targetAddress >= FocusRelocGuestStart && targetAddress <= FocusRelocGuestEnd)
-                {
-                    Console.Error.WriteLine($"[LOADER][FOCUS][SKIP] symbol name read failed offset={symbol.NameOffset}");
-                }
-                continue;
-            }
-
-            var nid = ExtractNid(symbolName);
-            if (string.IsNullOrWhiteSpace(nid))
-            {
-                skippedEmptyNid++;
-                continue;
-            }
-
-            if (seenImportNids.Add(nid))
-            {
-                orderedImportNids.Add(nid);
-            }
-
-            descriptors.Add(new RelocationDescriptor(
-                targetAddress,
-                addend,
-                nid,
-                0,
-                RelocationValueKind.Pointer));
        }

        Console.WriteLine($"[LOADER] Found {orderedImportNids.Count} unique NIDs, {descriptors.Count} descriptors");
-        Console.WriteLine(
-            $"[LOADER] Reloc skip stats: unsupported={skippedUnsupported}, unmapped={skippedUnmapped}, symbolRead={skippedSymbolRead}, nonImportBind={skippedNonImportBind}, nameRead={skippedNameRead}, emptyNid={skippedEmptyNid}");

        if (descriptors.Count == 0)
        {
@@ -709,6 +620,8 @@ public sealed class SelfLoader : ISelfLoader
            return EmptyImportStubs;
        }

+        importedRelocations = BuildImportedRelocations(descriptors);
+
        var stubsByAddress = CreateImportStubMapping(virtualMemory, orderedImportNids);
        Console.WriteLine($"[LOADER] Created {stubsByAddress.Count} import stubs");

@@ -784,6 +697,237 @@ public sealed class SelfLoader : ISelfLoader
        return stubsByAddress;
    }

+    private static int AppendSectionRelocationDescriptors(
+        ReadOnlySpan<byte> imageData,
+        LoadContext loadContext,
+        ElfHeader elfHeader,
+        IVirtualMemory virtualMemory,
+        ulong imageBase,
+        uint tlsModuleId,
+        ICollection<RelocationDescriptor> descriptors,
+        IList<string> orderedImportNids,
+        ISet<string> seenImportNids)
+    {
+        if (elfHeader.SectionHeaderOffset == 0 ||
+            elfHeader.SectionHeaderCount == 0 ||
+            elfHeader.SectionHeaderEntrySize < ElfSectionHeaderSize)
+        {
+            return 0;
+        }
+
+        var appendedRelocations = 0;
+        for (var sectionIndex = 0; sectionIndex < elfHeader.SectionHeaderCount; sectionIndex++)
+        {
+            if (!TryReadSectionHeader(imageData, loadContext, elfHeader, sectionIndex, out var relocationHeader) ||
+                relocationHeader.Type != SectionTypeRela ||
+                relocationHeader.Size == 0 ||
+                relocationHeader.EntrySize < ElfRelocationSize)
+            {
+                continue;
+            }
+
+            if (!TryReadElfRelativeSlice(imageData, loadContext, relocationHeader.Offset, relocationHeader.Size, out var relocationTable))
+            {
+                continue;
+            }
+
+            var relocations = new List<ElfRelocation>(checked((int)(relocationHeader.Size / relocationHeader.EntrySize)));
+            CollectRelocations(relocationTable, relocations);
+            if (relocations.Count == 0)
+            {
+                continue;
+            }
+
+            ReadOnlySpan<byte> symbolTable = ReadOnlySpan<byte>.Empty;
+            ReadOnlySpan<byte> stringTable = ReadOnlySpan<byte>.Empty;
+            if (relocationHeader.Link < elfHeader.SectionHeaderCount &&
+                TryReadSectionHeader(imageData, loadContext, elfHeader, (int)relocationHeader.Link, out var symbolHeader) &&
+                symbolHeader.Size != 0 &&
+                symbolHeader.EntrySize >= ElfSymbolSize &&
+                TryReadElfRelativeSlice(imageData, loadContext, symbolHeader.Offset, symbolHeader.Size, out symbolTable) &&
+                symbolHeader.Link < elfHeader.SectionHeaderCount &&
+                TryReadSectionHeader(imageData, loadContext, elfHeader, (int)symbolHeader.Link, out var stringHeader) &&
+                stringHeader.Size != 0 &&
+                TryReadElfRelativeSlice(imageData, loadContext, stringHeader.Offset, stringHeader.Size, out stringTable))
+            {
+            }
+
+            AppendRelocationDescriptors(
+                relocations,
+                symbolTable,
+                stringTable,
+                virtualMemory,
+                imageBase,
+                tlsModuleId,
+                descriptors,
+                orderedImportNids,
+                seenImportNids);
+            appendedRelocations += relocations.Count;
+        }
+
+        return appendedRelocations;
+    }
+
+    private static void AppendRelocationDescriptors(
+        IReadOnlyList<ElfRelocation> relocations,
+        ReadOnlySpan<byte> symbolTable,
+        ReadOnlySpan<byte> stringTable,
+        IVirtualMemory virtualMemory,
+        ulong imageBase,
+        uint tlsModuleId,
+        ICollection<RelocationDescriptor> descriptors,
+        IList<string> orderedImportNids,
+        ISet<string> seenImportNids)
+    {
+        foreach (var relocation in relocations)
+        {
+            if (IsFocusRelocationOffset(relocation.Offset, imageBase))
+            {
+                Console.Error.WriteLine(
+                    $"[LOADER][FOCUS][SCAN] off=0x{relocation.Offset:X16} type={relocation.Type} sym={relocation.SymbolIndex} addend=0x{relocation.Addend:X}");
+            }
+
+            if (!IsSupportedRelocationType(relocation.Type))
+            {
+                if (IsFocusRelocationOffset(relocation.Offset, imageBase))
+                {
+                    Console.Error.WriteLine($"[LOADER][FOCUS][SKIP] unsupported type={relocation.Type}");
+                }
+                continue;
+            }
+
+            if (!TryResolveMappedAddress(virtualMemory, relocation.Offset, imageBase, sizeof(ulong), out var targetAddress))
+            {
+                if (IsFocusRelocationOffset(relocation.Offset, imageBase))
+                {
+                    Console.Error.WriteLine("[LOADER][FOCUS][SKIP] target address not mapped");
+                }
+                continue;
+            }
+
+            if (relocation.Type == RelocationTypeRelative)
+            {
+                descriptors.Add(new RelocationDescriptor(
+                    targetAddress,
+                    relocation.Addend,
+                    null,
+                    imageBase,
+                    RelocationValueKind.Pointer,
+                    IsDataImport: false));
+                continue;
+            }
+
+            if (relocation.Type == RelocationTypeTlsModuleId)
+            {
+                var dtpmodValue = tlsModuleId == 0 ? 1u : tlsModuleId;
+                descriptors.Add(new RelocationDescriptor(
+                    targetAddress,
+                    0,
+                    null,
+                    dtpmodValue,
+                    RelocationValueKind.TlsModuleId,
+                    IsDataImport: false));
+                continue;
+            }
+
+            var symbolIndex = relocation.SymbolIndex;
+            ElfSymbol symbol;
+            if (symbolIndex == 0)
+            {
+                symbol = default;
+            }
+            else if (!TryReadSymbol(symbolTable, symbolIndex, out symbol))
+            {
+                if (targetAddress >= FocusRelocGuestStart && targetAddress <= FocusRelocGuestEnd)
+                {
+                    Console.Error.WriteLine($"[LOADER][FOCUS][SKIP] symbol read failed index={symbolIndex}");
+                }
+                continue;
+            }
+
+            var addend = relocation.Type is RelocationTypeGlobalData or RelocationTypeJumpSlot ? 0 : relocation.Addend;
+            var symbolBind = GetSymbolBind(symbol.Info);
+            if (symbolBind == SymbolBindLocal)
+            {
+                var symbolAddress = ResolveMappedAddressOrFallback(virtualMemory, symbol.Value, imageBase);
+                if (symbolAddress == 0)
+                {
+                    Console.Error.WriteLine(
+                        $"[LOADER] Skipping local relocation with invalid symbol value 0x{symbol.Value:X} " +
+                        $"at target 0x{targetAddress:X16}, type={relocation.Type}, sym={symbolIndex}");
+                    continue;
+                }
+
+                descriptors.Add(new RelocationDescriptor(
+                    targetAddress,
+                    addend,
+                    null,
+                    symbolAddress,
+                    RelocationValueKind.Pointer,
+                    IsDataImport: false));
+                continue;
+            }
+
+            if (symbol.Value != 0)
+            {
+                var symbolAddress = ResolveMappedAddressOrFallback(virtualMemory, symbol.Value, imageBase);
+                if (symbolAddress == 0)
+                {
+                    Console.Error.WriteLine(
+                        $"[LOADER] Skipping relocation with invalid symbol value 0x{symbol.Value:X} " +
+                        $"at target 0x{targetAddress:X16}, type={relocation.Type}, sym={symbolIndex}");
+                    continue;
+                }
+
+                descriptors.Add(new RelocationDescriptor(
+                    targetAddress,
+                    addend,
+                    null,
+                    symbolAddress,
+                    RelocationValueKind.Pointer,
+                    IsDataImport: false));
+                continue;
+            }
+
+            if (symbolBind is not (SymbolBindGlobal or SymbolBindWeak))
+            {
+                if (targetAddress >= FocusRelocGuestStart && targetAddress <= FocusRelocGuestEnd)
+                {
+                    Console.Error.WriteLine($"[LOADER][FOCUS][SKIP] bind={symbolBind} not importable");
+                }
+                continue;
+            }
+
+            if (!TryReadNullTerminatedAscii(stringTable, symbol.NameOffset, out var symbolName))
+            {
+                if (targetAddress >= FocusRelocGuestStart && targetAddress <= FocusRelocGuestEnd)
+                {
+                    Console.Error.WriteLine($"[LOADER][FOCUS][SKIP] symbol name read failed offset={symbol.NameOffset}");
+                }
+                continue;
+            }
+
+            var nid = ExtractNid(symbolName);
+            if (string.IsNullOrWhiteSpace(nid))
+            {
+                continue;
+            }
+
+            if (seenImportNids.Add(nid))
+            {
+                orderedImportNids.Add(nid);
+            }
+
+            descriptors.Add(new RelocationDescriptor(
+                targetAddress,
+                addend,
+                nid,
+                0,
+                RelocationValueKind.Pointer,
+                IsDataImport: GetSymbolType(symbol.Info) == SymbolTypeObject));
+        }
+    }
+
    private static void RegisterRuntimeSymbolsAndHooks(
        ReadOnlySpan<byte> imageData,
        LoadContext loadContext,
@@ -811,6 +955,159 @@ public sealed class SelfLoader : ISelfLoader
        }
    }

+    private static void CollectInitializerFunctions(
+        ReadOnlySpan<byte> imageData,
+        LoadContext loadContext,
+        IReadOnlyList<ProgramHeader> programHeaders,
+        IVirtualMemory virtualMemory,
+        ulong imageBase,
+        out ulong initFunctionEntryPoint,
+        out IReadOnlyList<ulong> preInitializerFunctions,
+        out IReadOnlyList<ulong> initializerFunctions)
+    {
+        initFunctionEntryPoint = 0;
+        preInitializerFunctions = EmptyInitializerFunctions;
+        initializerFunctions = EmptyInitializerFunctions;
+
+        if (!TryGetProgramHeader(programHeaders, ProgramHeaderType.Dynamic, out var dynamicHeader, out var dynamicHeaderIndex) ||
+            dynamicHeader.FileSize == 0)
+        {
+            return;
+        }
+
+        if (!TryLoadDynamicTableBytes(
+                imageData,
+                loadContext,
+                virtualMemory,
+                imageBase,
+                dynamicHeader,
+                dynamicHeaderIndex,
+                out var dynamicTable))
+        {
+            return;
+        }
+
+        var dynamicInfo = ParseDynamicInfo(dynamicTable);
+        var preInitializers = new List<ulong>(4);
+        var initializers = new List<ulong>(8);
+        initFunctionEntryPoint = ResolveMappedAddressOrFallback(virtualMemory, dynamicInfo.InitOffset, imageBase);
+        if (initFunctionEntryPoint < 0x10000)
+        {
+            initFunctionEntryPoint = 0;
+        }
+
+        AppendInitializerArrayEntries(
+            preInitializers,
+            imageData,
+            virtualMemory,
+            imageBase,
+            dynamicInfo.PreInitArrayOffset,
+            dynamicInfo.PreInitArraySize);
+
+        AppendResolvedInitializer(initializers, dynamicInfo.InitOffset, virtualMemory, imageBase);
+        AppendInitializerArrayEntries(
+            initializers,
+            imageData,
+            virtualMemory,
+            imageBase,
+            dynamicInfo.InitArrayOffset,
+            dynamicInfo.InitArraySize);
+
+        if (preInitializers.Count != 0)
+        {
+            preInitializerFunctions = preInitializers;
+        }
+
+        if (initializers.Count != 0)
+        {
+            initializerFunctions = initializers;
+        }
+
+        if (preInitializers.Count != 0 || initializers.Count != 0)
+        {
+            Console.Error.WriteLine(
+                $"[LOADER] Initializers discovered: preinit={preInitializers.Count}, init={initializers.Count}");
+        }
+    }
+
+    private static void AppendInitializerArrayEntries(
+        ICollection<ulong> destination,
+        ReadOnlySpan<byte> imageData,
+        IVirtualMemory virtualMemory,
+        ulong imageBase,
+        ulong arrayOffset,
+        ulong arraySize)
+    {
+        if (arrayOffset == 0 || arraySize < sizeof(ulong))
+        {
+            return;
+        }
+
+        if (!TryLoadTableBytes(imageData, virtualMemory, imageBase, arrayOffset, arraySize, out var arrayBytes))
+        {
+            return;
+        }
+
+        var entryCount = arrayBytes.Length / sizeof(ulong);
+        for (var i = 0; i < entryCount; i++)
+        {
+            var entryOffset = i * sizeof(ulong);
+            var entryAddress = BinaryPrimitives.ReadUInt64LittleEndian(arrayBytes.AsSpan(entryOffset, sizeof(ulong)));
+            AppendResolvedInitializer(destination, entryAddress, virtualMemory, imageBase);
+        }
+    }
+
+    private static void AppendResolvedInitializer(
+        ICollection<ulong> destination,
+        ulong functionAddress,
+        IVirtualMemory virtualMemory,
+        ulong imageBase)
+    {
+        var resolvedAddress = ResolveMappedAddressOrFallback(virtualMemory, functionAddress, imageBase);
+        if (resolvedAddress < 0x10000)
+        {
+            return;
+        }
+
+        foreach (var existing in destination)
+        {
+            if (existing == resolvedAddress)
+            {
+                return;
+            }
+        }
+
+        destination.Add(resolvedAddress);
+    }
+
+    private static IReadOnlyList<ImportedSymbolRelocation> BuildImportedRelocations(
+        IReadOnlyList<RelocationDescriptor> descriptors)
+    {
+        if (descriptors.Count == 0)
+        {
+            return Array.Empty<ImportedSymbolRelocation>();
+        }
+
+        var importedRelocations = new List<ImportedSymbolRelocation>(descriptors.Count);
+        foreach (var descriptor in descriptors)
+        {
+            if (descriptor.ImportNid is null || descriptor.ValueKind != RelocationValueKind.Pointer)
+            {
+                continue;
+            }
+
+            importedRelocations.Add(new ImportedSymbolRelocation(
+                descriptor.TargetAddress,
+                descriptor.Addend,
+                descriptor.ImportNid,
+                descriptor.IsDataImport));
+        }
+
+        return importedRelocations.Count == 0
+            ? Array.Empty<ImportedSymbolRelocation>()
+            : importedRelocations;
+    }
+
    private static int RegisterSectionRuntimeSymbols(
        ReadOnlySpan<byte> imageData,
        LoadContext loadContext,
@@ -909,9 +1206,18 @@ public sealed class SelfLoader : ISelfLoader
            return 0;
        }

-        var dynamicOffset = ResolvePhysicalSegmentOffset(imageData.Length, loadContext, dynamicHeader, dynamicHeaderIndex);
-        EnsureRange(imageData.Length, dynamicOffset, dynamicHeader.FileSize);
-        var dynamicTable = imageData.Slice((int)dynamicOffset, (int)dynamicHeader.FileSize);
+        if (!TryLoadDynamicTableBytes(
+                imageData,
+                loadContext,
+                virtualMemory,
+                imageBase,
+                dynamicHeader,
+                dynamicHeaderIndex,
+                out var dynamicTable))
+        {
+            return 0;
+        }
+
        var dynamicInfo = ParseDynamicInfo(dynamicTable);
        if (dynamicInfo.SymTabOffset == 0 || dynamicInfo.StrTabOffset == 0)
        {
@@ -1044,6 +1350,37 @@ public sealed class SelfLoader : ISelfLoader
        return true;
    }

+    private static bool TryLoadDynamicTableBytes(
+        ReadOnlySpan<byte> imageData,
+        LoadContext loadContext,
+        IVirtualMemory virtualMemory,
+        ulong imageBase,
+        ProgramHeader dynamicHeader,
+        int dynamicHeaderIndex,
+        out ReadOnlySpan<byte> dynamicTable)
+    {
+        if (TryLoadTableBytes(
+                imageData,
+                virtualMemory,
+                imageBase,
+                dynamicHeader.VirtualAddress,
+                dynamicHeader.FileSize,
+                out var loadedDynamicTable))
+        {
+            dynamicTable = loadedDynamicTable;
+            return true;
+        }
+
+        var dynamicOffset = ResolvePhysicalSegmentOffset(imageData.Length, loadContext, dynamicHeader, dynamicHeaderIndex);
+        if (!TrySlice(imageData, dynamicOffset, dynamicHeader.FileSize, out dynamicTable))
+        {
+            dynamicTable = default;
+            return false;
+        }
+
+        return true;
+    }
+
    private static bool TryReadElfRelativeSlice(
        ReadOnlySpan<byte> imageData,
        LoadContext loadContext,
@@ -1185,11 +1522,16 @@ public sealed class SelfLoader : ISelfLoader
        ulong strTabSize = 0;
        ulong symTabOffset = 0;
        ulong symTabSize = 0;
+        ulong initOffset = 0;
        ulong relaOffset = 0;
        ulong relaSize = 0;
        ulong jmpRelOffset = 0;
        ulong jmpRelSize = 0;
        ulong pltGotOffset = 0;
+        ulong initArrayOffset = 0;
+        ulong initArraySize = 0;
+        ulong preInitArrayOffset = 0;
+        ulong preInitArraySize = 0;

        for (var offset = 0; offset + DynamicEntrySize <= dynamicTable.Length; offset += DynamicEntrySize)
        {
@@ -1236,6 +1578,13 @@ public sealed class SelfLoader : ISelfLoader
                        relaSize = value;
                    }

+                    break;
+                case DtInit:
+                    if (initOffset == 0)
+                    {
+                        initOffset = value;
+                    }
+
                    break;
                case DtJmpRel:
                    if (jmpRelOffset == 0)
@@ -1243,6 +1592,34 @@ public sealed class SelfLoader : ISelfLoader
                        jmpRelOffset = value;
                    }

+                    break;
+                case DtInitArray:
+                    if (initArrayOffset == 0)
+                    {
+                        initArrayOffset = value;
+                    }
+
+                    break;
+                case DtInitArraySize:
+                    if (initArraySize == 0)
+                    {
+                        initArraySize = value;
+                    }
+
+                    break;
+                case DtPreInitArray:
+                    if (preInitArrayOffset == 0)
+                    {
+                        preInitArrayOffset = value;
+                    }
+
+                    break;
+                case DtPreInitArraySize:
+                    if (preInitArraySize == 0)
+                    {
+                        preInitArraySize = value;
+                    }
+
                    break;
                case DtPltRelSize:
                    if (jmpRelSize == 0)
@@ -1290,11 +1667,16 @@ public sealed class SelfLoader : ISelfLoader
            strTabSize,
            symTabOffset,
            symTabSize,
+            initOffset,
            relaOffset,
            relaSize,
            jmpRelOffset,
            jmpRelSize,
-            pltGotOffset);
+            pltGotOffset,
+            initArrayOffset,
+            initArraySize,
+            preInitArrayOffset,
+            preInitArraySize);
    }

    private static bool IsSupportedRelocationType(uint relocationType)
@@ -1512,6 +1894,11 @@ public sealed class SelfLoader : ISelfLoader
        return (byte)(info >> 4);
    }

+    private static byte GetSymbolType(byte info)
+    {
+        return (byte)(info & 0x0F);
+    }
+
    private static bool IsFocusRelocationOffset(ulong relocationOffset, ulong imageBase)
    {
        if (relocationOffset >= FocusRelocGuestStart && relocationOffset <= FocusRelocGuestEnd)
@@ -1896,11 +2283,16 @@ public sealed class SelfLoader : ISelfLoader
        ulong StrTabSize,
        ulong SymTabOffset,
        ulong SymTabSize,
+        ulong InitOffset,
        ulong RelaOffset,
        ulong RelaSize,
        ulong JmpRelOffset,
        ulong JmpRelSize,
-        ulong PltGotOffset)
+        ulong PltGotOffset,
+        ulong InitArrayOffset,
+        ulong InitArraySize,
+        ulong PreInitArrayOffset,
+        ulong PreInitArraySize)
    {
        public bool HasImportMetadata =>
            StrTabOffset != 0 &&
@@ -1947,7 +2339,8 @@ public sealed class SelfLoader : ISelfLoader
        long Addend,
        string? ImportNid,
        ulong SymbolValue,
-        RelocationValueKind ValueKind);
+        RelocationValueKind ValueKind,
+        bool IsDataImport);

    private enum SelfSegmentResolveStatus
    {
@@ -7,12 +7,17 @@ using SharpEmu.HLE;

 namespace SharpEmu.Core.Memory;

-public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IDisposable
+public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryAllocator, IDisposable
 {
    private readonly object _gate = new();
+    private readonly object _guestAllocationGate = new();
    private readonly List<MemoryRegion> _regions = new();
+    private readonly Dictionary<ulong, ProgramHeaderFlags> _pageProtections = new();
    private bool _disposed;
    private const ulong PageSize = 0x1000;
+    private const ulong GuestAllocationArenaAddress = 0x00006000_0000_0000;
+    private const ulong GuestAllocationArenaSize = 0x0100_0000;
+    private const ulong GuestAllocationArenaStartOffset = PageSize;
    private const ulong LargeDataReserveThreshold = 0x4000_0000UL; // 1 GiB
    private const ulong LazyReservePrimeBytes = 0x5000_0000UL; // 1.25 GiB
    private const ulong LazyReservePrimeChunkBytes = 0x0200_0000UL; // 32 MiB
@@ -24,9 +29,13 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IDisposable
    private const uint PAGE_EXECUTE_READWRITE = 0x40;
    private const uint PAGE_EXECUTE = 0x10;
    private const uint PAGE_EXECUTE_WRITECOPY = 0x80;
+    private const uint PAGE_NOACCESS = 0x01;
    private const uint PAGE_READWRITE = 0x04;
    private const uint PAGE_READONLY = 0x02;

+    private ulong _guestAllocationArenaBase;
+    private ulong _guestAllocationOffset;
+
    [DllImport("kernel32.dll", SetLastError = true)]
    private static extern void* VirtualAlloc(void* lpAddress, nuint dwSize, uint flAllocationType, uint flProtect);

@@ -38,6 +47,9 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IDisposable
    [return: MarshalAs(UnmanagedType.Bool)]
    private static extern bool VirtualProtect(void* lpAddress, nuint dwSize, uint flNewProtect, out uint lpflOldProtect);

+    [DllImport("kernel32.dll")]
+    private static extern nuint VirtualQuery(void* lpAddress, out MemoryBasicInformation64 lpBuffer, nuint dwLength);
+
    [DllImport("kernel32.dll")]
    private static extern void FlushInstructionCache(void* hProcess, void* lpBaseAddress, nuint dwSize);

@@ -124,7 +136,7 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IDisposable

            Console.Error.WriteLine($"[VMEM] Could not allocate at 0x{desiredAddress:X16}, trying any address...");
            result = VirtualAlloc(null, (nuint)alignedSize, allocationType, protection);
-            
+
            if (result == null)
            {
                if (!executable)
@@ -210,15 +222,111 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IDisposable
        return actualAddress;
    }

+    public bool TryAllocateAtOrAbove(
+        ulong desiredAddress,
+        ulong size,
+        bool executable,
+        ulong alignment,
+        out ulong actualAddress)
+    {
+        actualAddress = 0;
+        if (size == 0)
+        {
+            return false;
+        }
+
+        var alignedSize = AlignUp(size, PageSize);
+        var effectiveAlignment = Math.Max(PageSize, alignment == 0 ? PageSize : alignment);
+        var cursor = AlignUp(desiredAddress, effectiveAlignment);
+
+        for (var attempt = 0; attempt < 0x10000; attempt++)
+        {
+            if (cursor == 0 || ulong.MaxValue - cursor < alignedSize)
+            {
+                return false;
+            }
+
+            if (TryGetOverlappingRegionEnd(cursor, alignedSize, out var overlapEnd))
+            {
+                cursor = AlignUp(overlapEnd, effectiveAlignment);
+                continue;
+            }
+
+            try
+            {
+                actualAddress = AllocateAt(cursor, alignedSize, executable, allowAlternative: false);
+                if (actualAddress == cursor)
+                {
+                    return true;
+                }
+
+                actualAddress = 0;
+            }
+            catch
+            {
+            }
+
+            cursor = AlignUp(cursor + effectiveAlignment, effectiveAlignment);
+        }
+
+        return false;
+    }
+
+    public bool TryAllocateGuestMemory(ulong size, ulong alignment, out ulong address)
+    {
+        address = 0;
+        if (size == 0 || alignment == 0 || (alignment & (alignment - 1)) != 0)
+        {
+            return false;
+        }
+
+        lock (_guestAllocationGate)
+        {
+            if (_guestAllocationArenaBase == 0)
+            {
+                try
+                {
+                    _guestAllocationArenaBase = AllocateAt(
+                        GuestAllocationArenaAddress,
+                        GuestAllocationArenaSize,
+                        executable: false,
+                        allowAlternative: true);
+                    _guestAllocationOffset = GuestAllocationArenaStartOffset;
+                }
+                catch (Exception)
+                {
+                    return false;
+                }
+            }
+
+            var alignedOffset = AlignUp(_guestAllocationOffset, alignment);
+            if (alignedOffset > GuestAllocationArenaSize || size > GuestAllocationArenaSize - alignedOffset)
+            {
+                return false;
+            }
+
+            address = _guestAllocationArenaBase + alignedOffset;
+            _guestAllocationOffset = alignedOffset + size;
+            return true;
+        }
+    }
+
    public void Clear()
    {
-        lock (_gate)
+        lock (_guestAllocationGate)
        {
-            foreach (var region in _regions)
+            lock (_gate)
            {
-                VirtualFree((void*)region.VirtualAddress, 0, MEM_RELEASE);
+                foreach (var region in _regions)
+                {
+                    VirtualFree((void*)region.VirtualAddress, 0, MEM_RELEASE);
+                }
+                _regions.Clear();
+                _pageProtections.Clear();
            }
-            _regions.Clear();
+
+            _guestAllocationArenaBase = 0;
+            _guestAllocationOffset = 0;
        }
    }

@@ -264,20 +372,35 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IDisposable
                NativeMemory.Clear((void*)(virtualAddress + (ulong)fileData.Length), (nuint)zeroFillSize);
            }

-            SetProtection(mapStart, mapSize, protection);
+            ApplySegmentProtection(mapStart, mapEnd, protection);

            Console.Error.WriteLine($"[VMEM] Mapped segment: 0x{virtualAddress:X16} - 0x{virtualAddress + memorySize:X16} (file: {fileData.Length} bytes, prot: {protection})");
        }
    }

+    private void ApplySegmentProtection(ulong mapStart, ulong mapEnd, ProgramHeaderFlags flags)
+    {
+        for (var pageAddress = mapStart; pageAddress < mapEnd; pageAddress += PageSize)
+        {
+            _pageProtections.TryGetValue(pageAddress, out var existingFlags);
+            var mergedFlags = existingFlags | flags;
+            _pageProtections[pageAddress] = mergedFlags;
+            SetProtection(pageAddress, PageSize, mergedFlags);
+        }
+    }
+
    private void SetProtection(ulong address, ulong size, ProgramHeaderFlags flags)
    {
        uint protection;
-        
-        if ((flags & ProgramHeaderFlags.Execute) != 0)
+
+        if (flags == ProgramHeaderFlags.None)
        {
-            protection = (flags & ProgramHeaderFlags.Write) != 0 
-                ? PAGE_EXECUTE_READWRITE 
+            protection = PAGE_NOACCESS;
+        }
+        else if ((flags & ProgramHeaderFlags.Execute) != 0)
+        {
+            protection = (flags & ProgramHeaderFlags.Write) != 0
+                ? PAGE_EXECUTE_READWRITE
                : PAGE_EXECUTE_READ;
        }
        else if ((flags & ProgramHeaderFlags.Write) != 0)
@@ -309,10 +432,10 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IDisposable
            {
                var r = _regions[i];
                snapshot[i] = new VirtualMemoryRegion(
-                    r.VirtualAddress, 
-                    r.Size, 
-                    0, 
-                    r.Size, 
+                    r.VirtualAddress,
+                    r.Size,
+                    0,
+                    r.Size,
                    r.IsExecutable ? ProgramHeaderFlags.Execute | ProgramHeaderFlags.Read : ProgramHeaderFlags.Read);
            }
            return snapshot;
@@ -328,10 +451,33 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IDisposable
                if (TryResolveRegionOffset(virtualAddress, (ulong)destination.Length, region, out var offset))
                {
                    var srcPtr = (void*)(region.VirtualAddress + offset);
-                    fixed (byte* destPtr = destination)
+                    if (destination.IsEmpty)
                    {
-                        Buffer.MemoryCopy(srcPtr, destPtr, (nuint)destination.Length, (nuint)destination.Length);
+                        return true;
                    }
+
+                    if (!EnsureRangeCommitted((ulong)srcPtr, (ulong)destination.Length, region))
+                    {
+                        return false;
+                    }
+
+                    if (!TryTemporarilyProtectForRead((ulong)srcPtr, (ulong)destination.Length, region, out var touchedPages))
+                    {
+                        return false;
+                    }
+
+                    try
+                    {
+                        fixed (byte* destPtr = destination)
+                        {
+                            Buffer.MemoryCopy(srcPtr, destPtr, (nuint)destination.Length, (nuint)destination.Length);
+                        }
+                    }
+                    finally
+                    {
+                        RestorePageProtections(touchedPages);
+                    }
+
                    return true;
                }
            }
@@ -353,6 +499,11 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IDisposable
                        return true;
                    }

+                    if (!EnsureRangeCommitted((ulong)destPtr, (ulong)source.Length, region))
+                    {
+                        return false;
+                    }
+
                    if (!VirtualProtect(destPtr, (nuint)source.Length, PAGE_EXECUTE_READWRITE, out var oldProtect))
                    {
                        return false;
@@ -394,7 +545,7 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IDisposable
        {
            foreach (var region in _regions)
            {
-                if (virtualAddress >= region.VirtualAddress && 
+                if (virtualAddress >= region.VirtualAddress &&
                    virtualAddress < region.VirtualAddress + region.Size)
                {
                    return (void*)virtualAddress;
@@ -431,6 +582,30 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IDisposable
        return null;
    }

+    private bool TryGetOverlappingRegionEnd(ulong address, ulong size, out ulong overlapEnd)
+    {
+        overlapEnd = 0;
+        if (size == 0 || ulong.MaxValue - address < size - 1)
+        {
+            return false;
+        }
+
+        var end = address + size;
+        lock (_gate)
+        {
+            foreach (var region in _regions)
+            {
+                var regionEnd = region.VirtualAddress + region.Size;
+                if (address < regionEnd && region.VirtualAddress < end)
+                {
+                    overlapEnd = Math.Max(overlapEnd, regionEnd);
+                }
+            }
+        }
+
+        return overlapEnd != 0;
+    }
+
    private static bool TryResolveRegionOffset(ulong address, ulong size, MemoryRegion region, out ulong offset)
    {
        offset = 0;
@@ -458,6 +633,83 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IDisposable
        return protection is PAGE_EXECUTE or PAGE_EXECUTE_READ or PAGE_EXECUTE_READWRITE or PAGE_EXECUTE_WRITECOPY;
    }

+    private static uint GetCommitProtection(MemoryRegion region)
+    {
+        return region.IsExecutable ? PAGE_EXECUTE_READWRITE : PAGE_READWRITE;
+    }
+
+    private static unsafe bool EnsureRangeCommitted(ulong address, ulong size, MemoryRegion region)
+    {
+        if (size == 0 || !region.IsReservedOnly)
+        {
+            return true;
+        }
+
+        var startPage = AlignDown(address, PageSize);
+        var endPage = AlignUp(address + size, PageSize);
+        var commitProtection = GetCommitProtection(region);
+
+        for (var pageAddress = startPage; pageAddress < endPage; pageAddress += PageSize)
+        {
+            if (VirtualQuery((void*)pageAddress, out var info, (nuint)sizeof(MemoryBasicInformation64)) == 0)
+            {
+                return false;
+            }
+
+            if (info.State == MEM_COMMIT)
+            {
+                continue;
+            }
+
+            if (info.State != MEM_RESERVE)
+            {
+                return false;
+            }
+
+            if (VirtualAlloc((void*)pageAddress, (nuint)PageSize, MEM_COMMIT, commitProtection) == null)
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    private bool TryTemporarilyProtectForRead(
+        ulong address,
+        ulong size,
+        MemoryRegion region,
+        out List<(ulong Address, uint Protection)> touchedPages)
+    {
+        touchedPages = new List<(ulong Address, uint Protection)>();
+
+        var startPage = AlignDown(address, PageSize);
+        var endPage = AlignUp(address + size, PageSize);
+        var temporaryProtection = region.IsExecutable ? PAGE_EXECUTE_READWRITE : PAGE_READWRITE;
+
+        for (var pageAddress = startPage; pageAddress < endPage; pageAddress += PageSize)
+        {
+            if (!VirtualProtect((void*)pageAddress, (nuint)PageSize, temporaryProtection, out var oldProtection))
+            {
+                RestorePageProtections(touchedPages);
+                touchedPages.Clear();
+                return false;
+            }
+
+            touchedPages.Add((pageAddress, oldProtection));
+        }
+
+        return true;
+    }
+
+    private static void RestorePageProtections(List<(ulong Address, uint Protection)> touchedPages)
+    {
+        foreach (var (pageAddress, protection) in touchedPages)
+        {
+            VirtualProtect((void*)pageAddress, (nuint)PageSize, protection, out _);
+        }
+    }
+
    private static ulong AlignDown(ulong value, ulong alignment)
    {
        var mask = alignment - 1;
@@ -487,4 +739,17 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IDisposable
        public bool IsReservedOnly { get; set; }
        public uint Protection { get; set; }
    }
+
+    private struct MemoryBasicInformation64
+    {
+        public ulong BaseAddress;
+        public ulong AllocationBase;
+        public uint AllocationProtect;
+        public uint Alignment1;
+        public ulong RegionSize;
+        public uint State;
+        public uint Protect;
+        public uint Type;
+        public uint Alignment2;
+    }
 }
@@ -19,6 +19,8 @@ namespace SharpEmu.Core.Runtime;

 public sealed class SharpEmuRuntime : ISharpEmuRuntime
 {
+    private readonly record struct LoadedModuleImage(string Path, SelfImage Image);
+
    private static readonly HashSet<string> PreloadSkipModules = new(StringComparer.OrdinalIgnoreCase)
    {
        "libkernel.prx",
@@ -123,6 +125,8 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime

    public OrbisGen2Result Run(string ebootPath)
    {
+        var normalizedEbootPath = Path.GetFullPath(ebootPath);
+        using var app0Binding = BindApp0Root(normalizedEbootPath);
        Console.Error.WriteLine($"[RUNTIME] Loading: {ebootPath}");
        LastExecutionDiagnostics = null;
        LastExecutionTrace = null;
@@ -130,21 +134,41 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
        LastBasicBlockTrace = null;
        LastMilestoneLog = null;
        KernelModuleRegistry.Reset();
-        var image = LoadImage(ebootPath);
-        var normalizedEbootPath = Path.GetFullPath(ebootPath);
+        var image = LoadImage(normalizedEbootPath);
+        VideoOutExports.ConfigureApplicationInfo(image.Title, image.TitleId, image.Version);
        RegisterLoadedModule(normalizedEbootPath, image, isMain: true, isSystemModule: false);
        KernelRuntimeCompatExports.ConfigureProcessProcParamAddress(image.ProcParamAddress);
        Console.Error.WriteLine($"[RUNTIME] Entry: 0x{image.EntryPoint:X16}");
        var generation = image.ElfHeader.AbiVersion == 2 ? Generation.Gen5 : Generation.Gen4;
        var activeImportStubs = new Dictionary<ulong, string>(image.ImportStubs);
        var activeRuntimeSymbols = new Dictionary<string, ulong>(image.RuntimeSymbols, StringComparer.Ordinal);
-        LoadAdjacentSceModules(ebootPath, activeImportStubs, activeRuntimeSymbols);
        var processImageName = Path.GetFileName(ebootPath);
        if (string.IsNullOrWhiteSpace(processImageName))
        {
            processImageName = "eboot.bin";
        }

+        HleDataSymbols.ConfigureProcessImageName(processImageName);
+        MergeKnownHleDataSymbols(activeRuntimeSymbols);
+        var loadedModuleImages = LoadAdjacentSceModules(ebootPath, activeImportStubs, activeRuntimeSymbols);
+        RebindImportedDataSymbols(image, loadedModuleImages, activeRuntimeSymbols);
+        var initializerResult = RunAllInitializers(
+            image,
+            loadedModuleImages,
+            generation,
+            activeImportStubs,
+            activeRuntimeSymbols,
+            processImageName);
+        if (initializerResult is { } failedInitializerResult)
+        {
+            Console.Error.WriteLine($"[RUNTIME] Initializer dispatch failed: {failedInitializerResult}");
+            LastExecutionTrace = _cpuDispatcher.LastImportResolutionTrace;
+            LastMilestoneLog = _cpuDispatcher.LastMilestoneLog;
+            LastSessionSummary = BuildSessionSummary(_cpuDispatcher.LastSessionSummary);
+            LastBasicBlockTrace = _cpuDispatcher.LastBasicBlockTrace;
+            return failedInitializerResult;
+        }
+
        Console.Error.WriteLine($"[RUNTIME] Dispatching, gen: {generation}");
        Console.Error.WriteLine($"[RUNTIME] About to call DispatchEntry with entryPoint=0x{image.EntryPoint:X16}");

@@ -328,15 +352,189 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
        return result;
    }

-    private void LoadAdjacentSceModules(
+    private static App0BindingScope? BindApp0Root(string normalizedEbootPath)
+    {
+        const string app0VariableName = "SHARPEMU_APP0_DIR";
+        if (!string.IsNullOrWhiteSpace(Environment.GetEnvironmentVariable(app0VariableName)))
+        {
+            return null;
+        }
+
+        var app0Root = Path.GetDirectoryName(normalizedEbootPath);
+        if (string.IsNullOrWhiteSpace(app0Root))
+        {
+            return null;
+        }
+
+        Environment.SetEnvironmentVariable(app0VariableName, app0Root);
+        return new App0BindingScope(app0VariableName);
+    }
+
+    private sealed class App0BindingScope(string variableName) : IDisposable
+    {
+        private readonly string _variableName = variableName;
+        private bool _disposed;
+
+        public void Dispose()
+        {
+            if (_disposed)
+            {
+                return;
+            }
+
+            Environment.SetEnvironmentVariable(_variableName, null);
+            _disposed = true;
+        }
+    }
+
+    private OrbisGen2Result? RunAllInitializers(
+        SelfImage mainImage,
+        IReadOnlyList<LoadedModuleImage> loadedModuleImages,
+        Generation generation,
+        IReadOnlyDictionary<ulong, string> activeImportStubs,
+        IReadOnlyDictionary<string, ulong> activeRuntimeSymbols,
+        string processImageName)
+    {
+        var moduleStartResult = RunPreloadedModuleInitializers(
+            loadedModuleImages,
+            generation,
+            activeImportStubs,
+            activeRuntimeSymbols);
+        if (moduleStartResult is not null)
+        {
+            return moduleStartResult;
+        }
+
+        // On current PS5 dumps DT_INIT commonly resolves to imageBase+0x10, which is inside
+        // the mapped ELF header rather than a callable guest routine. Startup must remain
+        // guest-driven until the PS5 init/module ABI is identified precisely.
+        return null;
+    }
+
+    private OrbisGen2Result? RunPreloadedModuleInitializers(
+        IReadOnlyList<LoadedModuleImage> loadedModuleImages,
+        Generation generation,
+        IReadOnlyDictionary<ulong, string> activeImportStubs,
+        IReadOnlyDictionary<string, ulong> activeRuntimeSymbols)
+    {
+        for (var i = 0; i < loadedModuleImages.Count; i++)
+        {
+            var loadedModule = loadedModuleImages[i];
+            var initEntryPoint = loadedModule.Image.InitFunctionEntryPoint;
+            if (initEntryPoint < 0x10000)
+            {
+                continue;
+            }
+
+            var moduleName = Path.GetFileName(loadedModule.Path);
+            if (string.IsNullOrWhiteSpace(moduleName))
+            {
+                moduleName = $"module#{i}";
+            }
+
+            Console.Error.WriteLine(
+                $"[RUNTIME] Starting module {moduleName}: dt_init=0x{initEntryPoint:X16}");
+
+            var result = _cpuDispatcher.DispatchModuleInitializer(
+                initEntryPoint,
+                generation,
+                activeImportStubs,
+                activeRuntimeSymbols,
+                moduleName,
+                _cpuExecutionOptions);
+            if (result != OrbisGen2Result.ORBIS_GEN2_OK)
+            {
+                Console.Error.WriteLine(
+                    $"[RUNTIME] Module start failed: {moduleName} -> {result}");
+                return result;
+            }
+        }
+
+        return null;
+    }
+
+    private OrbisGen2Result? RunImageInitializers(
+        string label,
+        SelfImage image,
+        Generation generation,
+        IReadOnlyDictionary<ulong, string> activeImportStubs,
+        IReadOnlyDictionary<string, ulong> activeRuntimeSymbols,
+        string processImageName)
+    {
+        if (image.PreInitializerFunctions.Count == 0 && image.InitializerFunctions.Count == 0)
+        {
+            return null;
+        }
+
+        Console.Error.WriteLine(
+            $"[RUNTIME] Running initializers for {label}: preinit={image.PreInitializerFunctions.Count}, init={image.InitializerFunctions.Count}");
+
+        var result = RunInitializerList(
+            $"{label}:preinit",
+            image.PreInitializerFunctions,
+            generation,
+            activeImportStubs,
+            activeRuntimeSymbols,
+            processImageName);
+        if (result is not null)
+        {
+            return result;
+        }
+
+        return RunInitializerList(
+            $"{label}:init",
+            image.InitializerFunctions,
+            generation,
+            activeImportStubs,
+            activeRuntimeSymbols,
+            processImageName);
+    }
+
+    private OrbisGen2Result? RunInitializerList(
+        string label,
+        IReadOnlyList<ulong> initializerFunctions,
+        Generation generation,
+        IReadOnlyDictionary<ulong, string> activeImportStubs,
+        IReadOnlyDictionary<string, ulong> activeRuntimeSymbols,
+        string processImageName)
+    {
+        for (var i = 0; i < initializerFunctions.Count; i++)
+        {
+            var initializerAddress = initializerFunctions[i];
+            if (initializerAddress < 0x10000)
+            {
+                continue;
+            }
+
+            Console.Error.WriteLine(
+                $"[RUNTIME]   Initializer {label}[{i}] -> 0x{initializerAddress:X16}");
+
+            var result = _cpuDispatcher.DispatchEntry(
+                initializerAddress,
+                generation,
+                activeImportStubs,
+                activeRuntimeSymbols,
+                processImageName,
+                _cpuExecutionOptions);
+            if (result != OrbisGen2Result.ORBIS_GEN2_OK)
+            {
+                return result;
+            }
+        }
+
+        return null;
+    }
+
+    private List<LoadedModuleImage> LoadAdjacentSceModules(
        string ebootPath,
        IDictionary<ulong, string> importStubs,
        IDictionary<string, ulong> runtimeSymbols)
    {
+        var loadedImages = new List<LoadedModuleImage>();
        var ebootDirectory = Path.GetDirectoryName(ebootPath);
        if (string.IsNullOrWhiteSpace(ebootDirectory))
        {
-            return;
+            return loadedImages;
        }

        var moduleDirectories = new[]
@@ -350,7 +548,7 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime

        if (moduleDirectories.Length == 0)
        {
-            return;
+            return loadedImages;
        }

        var allModulePaths = moduleDirectories
@@ -380,7 +578,7 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime

        if (modulePaths.Length == 0)
        {
-            return;
+            return loadedImages;
        }

        Console.Error.WriteLine($"[RUNTIME] Module search directories: {string.Join(", ", moduleDirectories)}");
@@ -416,6 +614,7 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
                mergedImportCount += MergeImportStubs(importStubs, moduleImage.ImportStubs, modulePath);
                mergedSymbolCount += MergeRuntimeSymbols(runtimeSymbols, moduleImage.RuntimeSymbols);
                RegisterLoadedModule(modulePath, moduleImage, isMain: false, isSystemModule: false);
+                loadedImages.Add(new LoadedModuleImage(modulePath, moduleImage));
                loadedModules++;

                Console.Error.WriteLine(
@@ -430,6 +629,104 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime

        Console.Error.WriteLine(
            $"[RUNTIME] Module preload summary: loaded={loadedModules}, failed={failedModules}, merged_imports={mergedImportCount}, merged_symbols={mergedSymbolCount}");
+        return loadedImages;
+    }
+
+    private void RebindImportedDataSymbols(
+        SelfImage mainImage,
+        IReadOnlyList<LoadedModuleImage> loadedModuleImages,
+        IReadOnlyDictionary<string, ulong> runtimeSymbols)
+    {
+        var rebound = 0;
+        var unresolved = 0;
+
+        rebound += RebindImportedDataSymbols(mainImage, runtimeSymbols, ref unresolved);
+        for (var i = 0; i < loadedModuleImages.Count; i++)
+        {
+            rebound += RebindImportedDataSymbols(loadedModuleImages[i].Image, runtimeSymbols, ref unresolved);
+        }
+
+        if (rebound != 0 || unresolved != 0)
+        {
+            Console.Error.WriteLine(
+                $"[RUNTIME] Imported data rebind: rebound={rebound}, unresolved={unresolved}");
+        }
+    }
+
+    private int RebindImportedDataSymbols(
+        SelfImage image,
+        IReadOnlyDictionary<string, ulong> runtimeSymbols,
+        ref int unresolved)
+    {
+        if (image.ImportedRelocations.Count == 0)
+        {
+            return 0;
+        }
+
+        var rebound = 0;
+        var logRebind = string.Equals(
+            Environment.GetEnvironmentVariable("SHARPEMU_LOG_DATA_REBIND"),
+            "1",
+            StringComparison.Ordinal);
+        for (var i = 0; i < image.ImportedRelocations.Count; i++)
+        {
+            var relocation = image.ImportedRelocations[i];
+            if (!relocation.IsData)
+            {
+                continue;
+            }
+
+            if (!runtimeSymbols.TryGetValue(relocation.Nid, out var symbolAddress) ||
+                !IsUsableRuntimeSymbolAddress(symbolAddress))
+            {
+                if (logRebind)
+                {
+                    Console.Error.WriteLine(
+                        $"[RUNTIME] Imported data unresolved: nid={relocation.Nid} target=0x{relocation.TargetAddress:X16} addend=0x{unchecked((ulong)relocation.Addend):X16}");
+                }
+
+                unresolved++;
+                continue;
+            }
+
+            var reboundValue = AddSigned(symbolAddress, relocation.Addend);
+            if (!TryWriteUInt64(_virtualMemory, relocation.TargetAddress, reboundValue))
+            {
+                if (logRebind)
+                {
+                    Console.Error.WriteLine(
+                        $"[RUNTIME] Imported data write-failed: nid={relocation.Nid} target=0x{relocation.TargetAddress:X16} value=0x{reboundValue:X16}");
+                }
+
+                unresolved++;
+                continue;
+            }
+
+            if (logRebind)
+            {
+                Console.Error.WriteLine(
+                    $"[RUNTIME] Imported data rebound: nid={relocation.Nid} target=0x{relocation.TargetAddress:X16} value=0x{reboundValue:X16}");
+            }
+
+            rebound++;
+        }
+
+        return rebound;
+    }
+
+    private static void MergeKnownHleDataSymbols(IDictionary<string, ulong> runtimeSymbols)
+    {
+        foreach (var nid in HleDataSymbols.EnumerateKnownNids())
+        {
+            if (runtimeSymbols.ContainsKey(nid) ||
+                !HleDataSymbols.TryGetAddress(nid, out var symbolAddress) ||
+                !IsUsableRuntimeSymbolAddress(symbolAddress))
+            {
+                continue;
+            }
+
+            runtimeSymbols[nid] = symbolAddress;
+        }
    }

    private static int MergeImportStubs(
@@ -498,6 +795,24 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
        return address >= 0x10000 && !IsUnresolvedRuntimeSentinel(address);
    }

+    private static bool TryWriteUInt64(IVirtualMemory virtualMemory, ulong address, ulong value)
+    {
+        Span<byte> bytes = stackalloc byte[sizeof(ulong)];
+        BinaryPrimitives.WriteUInt64LittleEndian(bytes, value);
+        return virtualMemory.TryWrite(address, bytes);
+    }
+
+    private static ulong AddSigned(ulong value, long addend)
+    {
+        if (addend >= 0)
+        {
+            return unchecked(value + (ulong)addend);
+        }
+
+        var magnitude = unchecked((ulong)(-(addend + 1))) + 1;
+        return unchecked(value - magnitude);
+    }
+
    private static bool IsUnresolvedRuntimeSentinel(ulong value)
    {
        return value == 0xFFFEUL ||
@@ -8,17 +8,105 @@
        "resolved": "1.21.0",
        "contentHash": "dv5+81Q1TBQvVMSOOOmRcjJmvWcX3BZPZsIq31+RLc5cNft0IHAyNlkdb7ZarOWG913PyBoFDsDXoCIlKmLclg=="
      },
+      "Microsoft.DotNet.PlatformAbstractions": {
+        "type": "Transitive",
+        "resolved": "3.1.6",
+        "contentHash": "jek4XYaQ/PGUwDKKhwR8K47Uh1189PFzMeLqO83mXrXQVIpARZCcfuDedH50YDTepBkfijCZN5U/vZi++erxtg=="
+      },
+      "Microsoft.Extensions.DependencyModel": {
+        "type": "Transitive",
+        "resolved": "9.0.9",
+        "contentHash": "fNGvKct2De8ghm0Bpfq0iWthtzIWabgOTi+gJhNOPhNJIowXNEUE2eZNW/zNCzrHVA3PXg2yZ+3cWZndC2IqYA=="
+      },
+      "Silk.NET.Core": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "D7AT/nnwlB+4RZ84XY8QNGBZMJI5z9l4CSSETIJ1wCfRJzRt/341y3MRZ4HbnFz4r/IGaWOEZr86iE+0/65yyQ==",
+        "dependencies": {
+          "Microsoft.DotNet.PlatformAbstractions": "3.1.6",
+          "Microsoft.Extensions.DependencyModel": "9.0.9"
+        }
+      },
+      "Silk.NET.GLFW": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "UIs4sH57xlPUNHQ/1bt9rymPWlGy8IMDCNv86h0iM4TOA1CkIx0XM/n/tA4AReh1zQkNrvkxPEdZ3Blvy1dyXg==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0",
+          "Ultz.Native.GLFW": "3.4.0"
+        }
+      },
+      "Silk.NET.Maths": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "r8PdIVzME8EH0qAgbmRPO87I4GfgR2j8TofT7EMuRJDf1QluoQwnVypDoFJjQ2ZBSRsGYk5unYxxogI05Ogsmw=="
+      },
+      "Silk.NET.Windowing.Common": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "ThStSinmY9KQI8DGiF5XEhkLJVnBcgRTBTzL9ijg1wMZAYuckz7ykrNw04fjRm2Gryh6tCNGbvz2XaY0efeFzg==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0",
+          "Silk.NET.Maths": "2.23.0"
+        }
+      },
+      "Silk.NET.Windowing.Glfw": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "aYBudKmENmvLRn9p15HbdvlQTnnXskcDfTfbYwSb/4fr263rGLwYuDw/txUEc2jihHJiWCp5+75Y7z5wTJWl7g==",
+        "dependencies": {
+          "Silk.NET.GLFW": "2.23.0",
+          "Silk.NET.Windowing.Common": "2.23.0"
+        }
+      },
+      "Ultz.Native.GLFW": {
+        "type": "Transitive",
+        "resolved": "3.4.0",
+        "contentHash": "Iy22JopynbOJ32vA0lBhFEzGi65GQJBuJHYBYRBpydrDpNoTiHnjIXfA65Gu+8qsOr/ZEoIF8r9aHCgAXuO6DA=="
+      },
      "sharpemu.hle": {
        "type": "Project"
      },
      "sharpemu.libs": {
        "type": "Project",
        "dependencies": {
-          "SharpEmu.HLE": "[1.0.0, )"
+          "SharpEmu.HLE": "[1.0.0, )",
+          "Silk.NET.Vulkan": "[2.23.0, )",
+          "Silk.NET.Vulkan.Extensions.KHR": "[2.23.0, )",
+          "Silk.NET.Windowing": "[2.23.0, )"
        }
      },
      "sharpemu.logging": {
        "type": "Project"
+      },
+      "Silk.NET.Vulkan": {
+        "type": "CentralTransitive",
+        "requested": "[2.23.0, )",
+        "resolved": "2.23.0",
+        "contentHash": "3/irtlSWXZ3eTi8N6nelI6L34NTB8ZJHpqVMNzZx2aX7Ek9YEQ34NoQW8/Tljrtmkg8KRhHW8hKTEzZaKV8PgA==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0"
+        }
+      },
+      "Silk.NET.Vulkan.Extensions.KHR": {
+        "type": "CentralTransitive",
+        "requested": "[2.23.0, )",
+        "resolved": "2.23.0",
+        "contentHash": "uRaf4j+SmH3DumjSSSUbFg33BnsGZUyXGj93O9NgGKZSJN3OTmNmQDxRew+/KiVLcgH6qzbto8aNGZ++j9GFWg==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0",
+          "Silk.NET.Vulkan": "2.23.0"
+        }
+      },
+      "Silk.NET.Windowing": {
+        "type": "CentralTransitive",
+        "requested": "[2.23.0, )",
+        "resolved": "2.23.0",
+        "contentHash": "OPNPmt/lRyUKVYrFLQXVxyATqD3MKLc1iY1oKx1/2GppgmZxVZPwN12tekrQ4C7408kgB1L5JD1Wnirqqeb2kg==",
+        "dependencies": {
+          "Silk.NET.Windowing.Common": "2.23.0",
+          "Silk.NET.Windowing.Glfw": "2.23.0"
+        }
      }
    }
  }
@@ -0,0 +1,228 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE;
+
+public readonly record struct GuestThreadStartRequest(
+    ulong ThreadHandle,
+    ulong EntryPoint,
+    ulong Argument,
+    ulong AttributeAddress,
+    string Name);
+
+public interface IGuestThreadScheduler
+{
+    bool TryStartThread(CpuContext creatorContext, GuestThreadStartRequest request, out string? error);
+
+    void Pump(CpuContext callerContext, string reason);
+
+    bool TryCallGuestFunction(
+        CpuContext callerContext,
+        ulong entryPoint,
+        ulong arg0,
+        ulong arg1,
+        ulong stackAddress,
+        ulong stackSize,
+        string reason,
+        out string? error);
+
+    bool TryCallGuestContinuation(
+        CpuContext callerContext,
+        GuestCpuContinuation continuation,
+        string reason,
+        out string? error);
+}
+
+public readonly record struct GuestImportCallFrame(
+    bool IsValid,
+    ulong ReturnRip,
+    ulong ResumeRsp,
+    ulong ReturnSlotAddress);
+
+public readonly record struct GuestCpuContinuation(
+    ulong Rip,
+    ulong Rsp,
+    ulong ReturnSlotAddress,
+    ulong Rflags,
+    ulong FsBase,
+    ulong GsBase,
+    ulong Rax,
+    ulong Rcx,
+    ulong Rdx,
+    ulong Rbx,
+    ulong Rbp,
+    ulong Rsi,
+    ulong Rdi,
+    ulong R8,
+    ulong R9,
+    ulong R12,
+    ulong R13,
+    ulong R14,
+    ulong R15);
+
+public static class GuestThreadExecution
+{
+    [ThreadStatic]
+    private static ulong _currentGuestThreadHandle;
+
+    [ThreadStatic]
+    private static ulong _currentFiberAddress;
+
+    [ThreadStatic]
+    private static string? _pendingBlockReason;
+
+    [ThreadStatic]
+    private static bool _pendingEntryExit;
+
+    [ThreadStatic]
+    private static int _pendingEntryExitStatus;
+
+    [ThreadStatic]
+    private static string? _pendingEntryExitReason;
+
+    [ThreadStatic]
+    private static bool _hasCurrentImportCallFrame;
+
+    [ThreadStatic]
+    private static ulong _currentImportReturnRip;
+
+    [ThreadStatic]
+    private static ulong _currentImportResumeRsp;
+
+    [ThreadStatic]
+    private static ulong _currentImportReturnSlotAddress;
+
+    public static IGuestThreadScheduler? Scheduler { get; set; }
+
+    public static bool IsGuestThread => _currentGuestThreadHandle != 0;
+
+    public static ulong CurrentGuestThreadHandle => _currentGuestThreadHandle;
+
+    public static ulong CurrentFiberAddress => _currentFiberAddress;
+
+    public static ulong EnterGuestThread(ulong threadHandle)
+    {
+        var previous = _currentGuestThreadHandle;
+        _currentGuestThreadHandle = threadHandle;
+        _pendingBlockReason = null;
+        _pendingEntryExit = false;
+        _pendingEntryExitStatus = 0;
+        _pendingEntryExitReason = null;
+        _hasCurrentImportCallFrame = false;
+        _currentImportReturnRip = 0;
+        _currentImportResumeRsp = 0;
+        _currentImportReturnSlotAddress = 0;
+        return previous;
+    }
+
+    public static void RestoreGuestThread(ulong previousThreadHandle)
+    {
+        _currentGuestThreadHandle = previousThreadHandle;
+        _pendingBlockReason = null;
+        _pendingEntryExit = false;
+        _pendingEntryExitStatus = 0;
+        _pendingEntryExitReason = null;
+        _hasCurrentImportCallFrame = false;
+        _currentImportReturnRip = 0;
+        _currentImportResumeRsp = 0;
+        _currentImportReturnSlotAddress = 0;
+    }
+
+    public static ulong EnterFiber(ulong fiberAddress)
+    {
+        var previous = _currentFiberAddress;
+        _currentFiberAddress = fiberAddress;
+        return previous;
+    }
+
+    public static void RestoreFiber(ulong previousFiberAddress)
+    {
+        _currentFiberAddress = previousFiberAddress;
+    }
+
+    public static bool RequestCurrentThreadBlock(string reason)
+    {
+        if (!IsGuestThread)
+        {
+            return false;
+        }
+
+        _pendingBlockReason = string.IsNullOrWhiteSpace(reason) ? "guest_thread_blocked" : reason;
+        return true;
+    }
+
+    public static bool TryConsumeCurrentThreadBlock(out string reason)
+    {
+        reason = _pendingBlockReason ?? string.Empty;
+        if (string.IsNullOrEmpty(reason))
+        {
+            return false;
+        }
+
+        _pendingBlockReason = null;
+        return true;
+    }
+
+    public static void RequestCurrentEntryExit(string reason, int status)
+    {
+        _pendingEntryExit = true;
+        _pendingEntryExitStatus = status;
+        _pendingEntryExitReason = string.IsNullOrWhiteSpace(reason) ? "guest_entry_exit" : reason;
+    }
+
+    public static bool TryConsumeCurrentEntryExit(out int status, out string reason)
+    {
+        status = _pendingEntryExitStatus;
+        reason = _pendingEntryExitReason ?? string.Empty;
+        if (!_pendingEntryExit)
+        {
+            return false;
+        }
+
+        _pendingEntryExit = false;
+        _pendingEntryExitStatus = 0;
+        _pendingEntryExitReason = null;
+        return true;
+    }
+
+    public static GuestImportCallFrame EnterImportCallFrame(
+        ulong returnRip,
+        ulong resumeRsp,
+        ulong returnSlotAddress)
+    {
+        var previous = new GuestImportCallFrame(
+            _hasCurrentImportCallFrame,
+            _currentImportReturnRip,
+            _currentImportResumeRsp,
+            _currentImportReturnSlotAddress);
+        _hasCurrentImportCallFrame = true;
+        _currentImportReturnRip = returnRip;
+        _currentImportResumeRsp = resumeRsp;
+        _currentImportReturnSlotAddress = returnSlotAddress;
+        return previous;
+    }
+
+    public static void RestoreImportCallFrame(GuestImportCallFrame previous)
+    {
+        _hasCurrentImportCallFrame = previous.IsValid;
+        _currentImportReturnRip = previous.ReturnRip;
+        _currentImportResumeRsp = previous.ResumeRsp;
+        _currentImportReturnSlotAddress = previous.ReturnSlotAddress;
+    }
+
+    public static bool TryGetCurrentImportCallFrame(out GuestImportCallFrame frame)
+    {
+        if (!_hasCurrentImportCallFrame)
+        {
+            frame = default;
+            return false;
+        }
+
+        frame = new GuestImportCallFrame(
+            true,
+            _currentImportReturnRip,
+            _currentImportResumeRsp,
+            _currentImportReturnSlotAddress);
+        return true;
+    }
+}
@@ -0,0 +1,130 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Runtime.InteropServices;
+using System.Text;
+
+namespace SharpEmu.HLE;
+
+public static class HleDataSymbols
+{
+    private const string StackChkGuardNid = "f7uOxY9mM1U";
+    private const string ProgNameNid = "djxxOmW6-aw";
+    private const string LibcNeedFlagNid = "P330P3dFF68";
+    private const string LibcInternalNeedFlagNid = "ZT4ODD2Ts9o";
+    private const int ProgNameMaxBytes = 511;
+    private const ulong StackChkGuardValue = 0xC0DEC0DECAFEBABEUL;
+
+    private static readonly object _gate = new();
+    private static readonly nint _stackChkGuardAddress = Allocate(sizeof(ulong) * 2);
+    private static readonly nint _progNameBufferAddress = Allocate(ProgNameMaxBytes + 1);
+    private static readonly nint _progNamePointerAddress = Allocate(nint.Size);
+    private static readonly nint _libcNeedFlagAddress = Allocate(sizeof(uint));
+    private static readonly nint _libcInternalNeedFlagAddress = Allocate(sizeof(uint));
+
+    static HleDataSymbols()
+    {
+        if (_stackChkGuardAddress != 0)
+        {
+            Marshal.WriteInt64(_stackChkGuardAddress, unchecked((long)StackChkGuardValue));
+            Marshal.WriteInt64(
+                IntPtr.Add(_stackChkGuardAddress, sizeof(ulong)),
+                unchecked((long)StackChkGuardValue));
+        }
+
+        if (_libcNeedFlagAddress != 0)
+        {
+            Marshal.WriteInt32(_libcNeedFlagAddress, 1);
+        }
+
+        if (_libcInternalNeedFlagAddress != 0)
+        {
+            Marshal.WriteInt32(_libcInternalNeedFlagAddress, 1);
+        }
+
+        ConfigureProcessImageName("eboot.bin");
+    }
+
+    public static IEnumerable<string> EnumerateKnownNids()
+    {
+        yield return StackChkGuardNid;
+        yield return ProgNameNid;
+        yield return LibcNeedFlagNid;
+        yield return LibcInternalNeedFlagNid;
+    }
+
+    public static void ConfigureProcessImageName(string? processImageName)
+    {
+        var effectiveName = string.IsNullOrWhiteSpace(processImageName)
+            ? "eboot.bin"
+            : processImageName;
+        var encodedName = Encoding.UTF8.GetBytes(effectiveName);
+        var byteCount = Math.Min(encodedName.Length, ProgNameMaxBytes);
+
+        lock (_gate)
+        {
+            if (_progNameBufferAddress == 0 || _progNamePointerAddress == 0)
+            {
+                return;
+            }
+
+            for (var i = 0; i <= ProgNameMaxBytes; i++)
+            {
+                Marshal.WriteByte(_progNameBufferAddress, i, 0);
+            }
+
+            Marshal.Copy(encodedName, 0, _progNameBufferAddress, byteCount);
+            WritePointer(_progNamePointerAddress, _progNameBufferAddress);
+        }
+    }
+
+    public static bool TryGetAddress(string nid, out ulong address)
+    {
+        var pointer = nid switch
+        {
+            StackChkGuardNid => _stackChkGuardAddress,
+            ProgNameNid => _progNamePointerAddress,
+            LibcNeedFlagNid => _libcNeedFlagAddress,
+            LibcInternalNeedFlagNid => _libcInternalNeedFlagAddress,
+            _ => 0,
+        };
+
+        if (pointer == 0)
+        {
+            address = 0;
+            return false;
+        }
+
+        address = unchecked((ulong)pointer);
+        return true;
+    }
+
+    private static nint Allocate(int size)
+    {
+        try
+        {
+            var memory = Marshal.AllocHGlobal(size);
+            for (var i = 0; i < size; i++)
+            {
+                Marshal.WriteByte(memory, i, 0);
+            }
+
+            return memory;
+        }
+        catch
+        {
+            return 0;
+        }
+    }
+
+    private static void WritePointer(nint target, nint value)
+    {
+        if (nint.Size == sizeof(int))
+        {
+            Marshal.WriteInt32(target, value.ToInt32());
+            return;
+        }
+
+        Marshal.WriteInt64(target, value.ToInt64());
+    }
+}
@@ -0,0 +1,9 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE;
+
+public interface IGuestMemoryAllocator
+{
+    bool TryAllocateGuestMemory(ulong size, ulong alignment, out ulong address);
+}
@@ -17,5 +17,7 @@ public interface IModuleManager

    bool TryGetExportByName(string exportName, out ExportedFunction export);

+    bool TryDispatch(string nid, CpuContext context, out OrbisGen2Result result);
+
    OrbisGen2Result Dispatch(string nid, CpuContext context);
 }
@@ -93,6 +93,12 @@ public sealed class ModuleManager : IModuleManager
    }

    public OrbisGen2Result Dispatch(string nid, CpuContext context)
+    {
+        TryDispatch(nid, context, out var result);
+        return result;
+    }
+
+    public bool TryDispatch(string nid, CpuContext context, out OrbisGen2Result result)
    {
        ArgumentException.ThrowIfNullOrWhiteSpace(nid);
        ArgumentNullException.ThrowIfNull(context);
@@ -100,13 +106,15 @@ public sealed class ModuleManager : IModuleManager
        if (!_dispatchTable.TryGetValue(nid, out var function) || !_exportTable.TryGetValue(nid, out var export))
        {
            context[CpuRegister.Rax] = unchecked((ulong)(int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND);
-            return OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+            result = OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+            return false;
        }

        if ((export.Target & context.TargetGeneration) == 0)
        {
            context[CpuRegister.Rax] = unchecked((ulong)(int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND);
-            return OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+            result = OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+            return false;
        }

        context.ClearRaxWriteFlag();
@@ -117,7 +125,8 @@ public sealed class ModuleManager : IModuleManager
            context[CpuRegister.Rax] = unchecked((ulong)ret);
        }

-        return (OrbisGen2Result)ret;
+        result = (OrbisGen2Result)ret;
+        return true;
    }

    private static Delegate CreateHandler(Type ownerType, MethodInfo method, IDictionary<Type, object> instances)
@@ -15,6 +15,11 @@ public enum OrbisGen2Result : int
    /// </summary>
    ORBIS_GEN2_OK = 0,

+    /// <summary>
+    /// Indicates that the operation is not permitted for the calling thread.
+    /// </summary>
+    ORBIS_GEN2_ERROR_PERMISSION_DENIED = unchecked((int)0x80020001),
+
    /// <summary>
    /// Indicates that the requested export was not found.
    /// </summary>
@@ -30,11 +35,31 @@ public enum OrbisGen2Result : int
    /// </summary>
    ORBIS_GEN2_ERROR_ALREADY_EXISTS = unchecked((int)0x80020004),

+    /// <summary>
+    /// Indicates that completing the operation would deadlock.
+    /// </summary>
+    ORBIS_GEN2_ERROR_DEADLOCK = unchecked((int)0x8002000B),
+
+    /// <summary>
+    /// Indicates that the target resource is busy.
+    /// </summary>
+    ORBIS_GEN2_ERROR_BUSY = unchecked((int)0x80020010),
+
+    /// <summary>
+    /// Indicates that the operation should be retried later.
+    /// </summary>
+    ORBIS_GEN2_ERROR_TRY_AGAIN = unchecked((int)0x80020023),
+
    /// <summary>
    /// Indicates that behavior is recognized but not implemented yet.
    /// </summary>
    ORBIS_GEN2_ERROR_NOT_IMPLEMENTED = unchecked((int)0x8002FFFF),

+    /// <summary>
+    /// Indicates that the operation timed out.
+    /// </summary>
+    ORBIS_GEN2_ERROR_TIMED_OUT = unchecked((int)0x8002003C),
+
    /// <summary>
    /// Indicates that memory access failed.
    /// </summary>
@@ -0,0 +1,73 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+using SharpEmu.Libs.VideoOut;
+using System.Buffers.Binary;
+
+namespace SharpEmu.Libs.Agc;
+
+internal static class Gen5ShaderTranslator
+{
+    private static readonly uint[] FullscreenBarycentricEs =
+    [
+        0xBFA00001, 0x7E000000, 0x7E000000, 0x7E000000,
+        0x93EBFF03, 0x00080008, 0x8F6A8C6B, 0x8700FF03,
+        0x000000FF, 0x887C6A00, 0xBF900009, 0x81EA6BC0,
+        0x90FE6AC1, 0xF8000941, 0x00000000, 0x81EA00C0,
+        0xBF8CFF0F, 0x90FE6AC1, 0x36040A81, 0x2C060A81,
+        0x7E000280, 0x7E0202F2, 0xD7460002, 0x03050302,
+        0xD7460003, 0x03050303, 0x7E040B02, 0x7E060B03,
+        0xF80008CF, 0x01000302, 0xBF810000,
+    ];
+
+    private static readonly uint[] FullscreenBarycentricPs =
+    [
+        0xD52F0000, 0x00000200,
+        0xD52F0001, 0x00000602,
+        0xF8001C0F, 0x00000100,
+        0xBF810000,
+    ];
+
+    public static bool TryTranslate(
+        CpuContext ctx,
+        ulong exportShaderAddress,
+        ulong pixelShaderAddress,
+        uint psInputEna,
+        uint psInputAddr,
+        out GuestDrawKind drawKind)
+    {
+        drawKind = GuestDrawKind.None;
+        if (exportShaderAddress == 0 ||
+            pixelShaderAddress == 0 ||
+            psInputEna != 0x00000002 ||
+            psInputAddr != 0x00000002 ||
+            !MatchesProgram(ctx, exportShaderAddress, FullscreenBarycentricEs) ||
+            !MatchesProgram(ctx, pixelShaderAddress, FullscreenBarycentricPs))
+        {
+            return false;
+        }
+
+        drawKind = GuestDrawKind.FullscreenBarycentric;
+        return true;
+    }
+
+    private static bool MatchesProgram(CpuContext ctx, ulong address, ReadOnlySpan<uint> expected)
+    {
+        var bytes = new byte[expected.Length * sizeof(uint)];
+        if (!ctx.Memory.TryRead(address, bytes))
+        {
+            return false;
+        }
+
+        for (var index = 0; index < expected.Length; index++)
+        {
+            if (BinaryPrimitives.ReadUInt32LittleEndian(bytes.AsSpan(index * sizeof(uint))) != expected[index])
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+}
@@ -0,0 +1,813 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+using SharpEmu.Libs.Kernel;
+using System.Buffers.Binary;
+using System.Collections.Concurrent;
+
+namespace SharpEmu.Libs.Ampr;
+
+public static class AmprExports
+{
+    private const int CommandBufferHeaderSize = 0x28;
+    private const ulong CommandBufferSelfOffset = 0x00;
+    private const ulong CommandBufferDataOffset = 0x08;
+    private const ulong CommandBufferSizeOffset = 0x10;
+    private const ulong CommandBufferAux0Offset = 0x18;
+    private const ulong CommandBufferAux1Offset = 0x20;
+    private const ulong ReadFileRecordSize = 0x30;
+    private const ulong KernelEventQueueRecordSize = 0x30;
+    private const ulong WriteAddressRecordSize = 0x20;
+    private const uint ReadFileRecordType = 1;
+    private const uint KernelEventQueueRecordType = 2;
+    private const uint WriteAddressRecordType = 3;
+    private static readonly ConcurrentDictionary<ulong, CommandBufferState> _commandBuffers = new();
+
+    private sealed class CommandBufferState
+    {
+        public ulong Buffer;
+        public ulong Size;
+        public ulong WriteOffset;
+    }
+
+    [SysAbiExport(
+        Nid = "8aI7R7WaOlc",
+        ExportName = "sceAmprCommandBufferConstructor",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAmpr")]
+    public static int CommandBufferConstructor(CpuContext ctx)
+    {
+        var commandBuffer = ctx[CpuRegister.Rdi];
+        var buffer = ctx[CpuRegister.Rsi];
+        var size = ctx[CpuRegister.Rdx];
+
+        if (commandBuffer == 0)
+        {
+            ctx[CpuRegister.Rax] = 0;
+            return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+        }
+
+        if (!InitializeCommandBuffer(ctx, commandBuffer, buffer, size, aux0: 0, aux1: 0, clear: true))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        TraceAmpr(ctx, "ctor", commandBuffer, buffer, size);
+        ctx[CpuRegister.Rax] = commandBuffer;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "a8uLzYY--tM",
+        ExportName = "sceAmprAprCommandBufferConstructor",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAmpr")]
+    public static int AprCommandBufferConstructor(CpuContext ctx)
+    {
+        var commandBuffer = ctx[CpuRegister.Rdi];
+        var aux0 = ctx[CpuRegister.Rsi];
+        var aux1 = ctx[CpuRegister.Rdx];
+
+        if (commandBuffer == 0)
+        {
+            ctx[CpuRegister.Rax] = 0;
+            return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+        }
+
+        var buffer = 0UL;
+        var size = 0UL;
+        _ = ctx.TryReadUInt64(commandBuffer + CommandBufferDataOffset, out buffer);
+        _ = ctx.TryReadUInt64(commandBuffer + CommandBufferSizeOffset, out size);
+
+        if (!InitializeCommandBuffer(ctx, commandBuffer, buffer, size, aux0, aux1, clear: false))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        TraceAmpr(ctx, "apr_ctor", commandBuffer, aux0, aux1);
+        ctx[CpuRegister.Rax] = commandBuffer;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "Qs1xtplKo0U",
+        ExportName = "sceAmprAprCommandBufferDestructor",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAmpr")]
+    public static int AprCommandBufferDestructor(CpuContext ctx)
+    {
+        var commandBuffer = ctx[CpuRegister.Rdi];
+        if (commandBuffer == 0)
+        {
+            ctx[CpuRegister.Rax] = 0;
+            return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+        }
+
+        if (!ctx.TryWriteUInt64(commandBuffer + CommandBufferAux0Offset, 0) ||
+            !ctx.TryWriteUInt64(commandBuffer + CommandBufferAux1Offset, 0))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        TraceAmpr(ctx, "apr_dtor", commandBuffer, 0, 0);
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "GuchCTefuZw",
+        ExportName = "sceAmprCommandBufferDestructor",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAmpr")]
+    public static int CommandBufferDestructor(CpuContext ctx)
+    {
+        var commandBuffer = ctx[CpuRegister.Rdi];
+        if (commandBuffer == 0)
+        {
+            ctx[CpuRegister.Rax] = 0;
+            return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+        }
+
+        if (!WriteVisibleCommandBufferPointers(ctx, commandBuffer, buffer: 0, size: 0))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        _commandBuffers.TryRemove(commandBuffer, out _);
+        TraceAmpr(ctx, "dtor", commandBuffer, 0, 0);
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "N-FSPA4S3nI",
+        ExportName = "sceAmprCommandBufferSetBuffer",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAmpr")]
+    public static int CommandBufferSetBuffer(CpuContext ctx)
+    {
+        var commandBuffer = ctx[CpuRegister.Rdi];
+        var buffer = ctx[CpuRegister.Rsi];
+        var size = ctx[CpuRegister.Rdx];
+
+        if (commandBuffer == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        if (!WriteCommandBufferPointers(ctx, commandBuffer, buffer, size))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        TraceAmpr(ctx, "set_buffer", commandBuffer, buffer, size);
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "baQO9ez2gL4",
+        ExportName = "sceAmprCommandBufferReset",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAmpr")]
+    public static int CommandBufferReset(CpuContext ctx)
+    {
+        var commandBuffer = ctx[CpuRegister.Rdi];
+        if (commandBuffer == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        if (!ctx.TryReadUInt64(commandBuffer + CommandBufferDataOffset, out var buffer) ||
+            !ctx.TryReadUInt64(commandBuffer + CommandBufferSizeOffset, out var size) ||
+            !WriteCommandBufferPointers(ctx, commandBuffer, buffer, size, writeOffset: 0))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        TraceAmpr(ctx, "reset", commandBuffer, buffer, size);
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "ULvXMDz56po",
+        ExportName = "sceAmprCommandBufferClearBuffer",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAmpr")]
+    public static int CommandBufferClearBuffer(CpuContext ctx)
+    {
+        var commandBuffer = ctx[CpuRegister.Rdi];
+        if (commandBuffer == 0)
+        {
+            ctx[CpuRegister.Rax] = 0;
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        if (!TryGetCommandBufferState(ctx, commandBuffer, out var buffer, out var size, out _) ||
+            !WriteVisibleCommandBufferPointers(ctx, commandBuffer, buffer: 0, size: 0))
+        {
+            ctx[CpuRegister.Rax] = 0;
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        _commandBuffers.TryRemove(commandBuffer, out _);
+        TraceAmpr(ctx, "clear_buffer", commandBuffer, buffer, size);
+        ctx[CpuRegister.Rax] = buffer;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "mQ16-QdKv7k",
+        ExportName = "sceAmprAprCommandBufferReadFile",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAmpr")]
+    public static int AprCommandBufferReadFile(CpuContext ctx)
+    {
+        var commandBuffer = ctx[CpuRegister.Rdi];
+        var fileId = unchecked((uint)ctx[CpuRegister.Rcx]);
+        var destination = ctx[CpuRegister.R8];
+        var size = ctx[CpuRegister.R9];
+
+        if (commandBuffer == 0 || (destination == 0 && size != 0))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        if (!ctx.TryReadUInt64(ctx[CpuRegister.Rsp] + sizeof(ulong), out var fileOffset))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        if (!AmprFileRegistry.TryGetHostPath(fileId, out var hostPath) || !File.Exists(hostPath))
+        {
+            TraceAmprRead(ctx, commandBuffer, fileId, destination, size, fileOffset, bytesRead: 0, hostPath, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND);
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+        }
+
+        var result = TryReadFileToGuestMemory(ctx, hostPath, fileOffset, destination, size, out var bytesRead);
+        if (result != (int)OrbisGen2Result.ORBIS_GEN2_OK)
+        {
+            TraceAmprRead(ctx, commandBuffer, fileId, destination, size, fileOffset, bytesRead, hostPath, result);
+            return result;
+        }
+
+        if (!AppendReadFileRecord(ctx, commandBuffer, fileId, destination, size, fileOffset, bytesRead))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        TraceAmprRead(ctx, commandBuffer, fileId, destination, size, fileOffset, bytesRead, hostPath, (int)OrbisGen2Result.ORBIS_GEN2_OK);
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "vWU-odnS+fU",
+        ExportName = "sceAmprMeasureCommandSizeReadFile",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAmpr")]
+    public static int MeasureCommandSizeReadFile(CpuContext ctx)
+    {
+        TraceAmpr(ctx, "measure_read_file", 0, ReadFileRecordSize, 0);
+        ctx[CpuRegister.Rax] = ReadFileRecordSize;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "sSAUCCU1dv4",
+        ExportName = "sceAmprMeasureCommandSizeWriteKernelEventQueue_04_00",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAmpr")]
+    public static int MeasureCommandSizeWriteKernelEventQueue0400(CpuContext ctx)
+    {
+        TraceAmpr(ctx, "measure_write_equeue", 0, KernelEventQueueRecordSize, 0);
+        ctx[CpuRegister.Rax] = KernelEventQueueRecordSize;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "C+IEj+BsAFM",
+        ExportName = "sceAmprMeasureCommandSizeWriteAddressOnCompletion",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAmpr")]
+    public static int MeasureCommandSizeWriteAddressOnCompletion(CpuContext ctx)
+    {
+        TraceAmpr(ctx, "measure_write_address_complete", 0, WriteAddressRecordSize, 0);
+        ctx[CpuRegister.Rax] = WriteAddressRecordSize;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "tZDDEo2tE5k",
+        ExportName = "sceAmprCommandBufferGetSize",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAmpr")]
+    public static int CommandBufferGetSize(CpuContext ctx)
+    {
+        var commandBuffer = ctx[CpuRegister.Rdi];
+        if (commandBuffer == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        if (!TryGetCommandBufferState(ctx, commandBuffer, out _, out var size, out _))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        TraceAmpr(ctx, "get_size", commandBuffer, size, 0);
+        ctx[CpuRegister.Rax] = size;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "GnxKOHEawhk",
+        ExportName = "sceAmprCommandBufferGetCurrentOffset",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAmpr")]
+    public static int CommandBufferGetCurrentOffset(CpuContext ctx)
+    {
+        var commandBuffer = ctx[CpuRegister.Rdi];
+        if (commandBuffer == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        if (!TryGetCommandBufferOffset(ctx, commandBuffer, out var offset))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        TraceAmpr(ctx, "get_offset", commandBuffer, offset, 0);
+        ctx[CpuRegister.Rax] = offset;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "H896Pt-yB4I",
+        ExportName = "sceAmprCommandBufferWriteKernelEventQueue_04_00",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAmpr")]
+    public static int CommandBufferWriteKernelEventQueue0400(CpuContext ctx)
+    {
+        var commandBuffer = ctx[CpuRegister.Rdi];
+        var equeue = ctx[CpuRegister.Rsi];
+        var ident = ctx[CpuRegister.Rdx];
+        var filter = ctx[CpuRegister.Rcx];
+        var userData = ctx[CpuRegister.R8];
+        var data = ctx[CpuRegister.R9];
+
+        if (commandBuffer == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        var extra = 0UL;
+        _ = ctx.TryReadUInt64(ctx[CpuRegister.Rsp] + sizeof(ulong), out extra);
+
+        if (!AppendKernelEventQueueRecord(ctx, commandBuffer, equeue, ident, filter, userData, data, extra))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        TraceAmpr(ctx, "write_equeue", commandBuffer, equeue, ident);
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "sJXyWHjP-F8",
+        ExportName = "sceAmprCommandBufferWriteAddressOnCompletion",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAmpr")]
+    public static int CommandBufferWriteAddressOnCompletion(CpuContext ctx)
+    {
+        var commandBuffer = ctx[CpuRegister.Rdi];
+        var address = ctx[CpuRegister.Rsi];
+        var value = ctx[CpuRegister.Rdx];
+
+        if (commandBuffer == 0 || address == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        if (!AppendWriteAddressRecord(ctx, commandBuffer, address, value))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        TraceAmpr(ctx, "write_address_complete", commandBuffer, address, value);
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    public static int CompleteCommandBuffer(CpuContext ctx, ulong commandBuffer)
+    {
+        if (commandBuffer == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        if (!TryGetCommandBufferState(ctx, commandBuffer, out var buffer, out _, out var state) || state is null)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        ulong writeOffset;
+        lock (state)
+        {
+            writeOffset = state.WriteOffset;
+        }
+
+        var offset = 0UL;
+        while (offset < writeOffset)
+        {
+            if (!TryReadUInt32(ctx, buffer + offset, out var recordType))
+            {
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+            }
+
+            switch (recordType)
+            {
+                case ReadFileRecordType:
+                    offset += ReadFileRecordSize;
+                    break;
+
+                case KernelEventQueueRecordType:
+                    if (!CompleteKernelEventQueueRecord(ctx, buffer + offset))
+                    {
+                        return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+                    }
+
+                    offset += KernelEventQueueRecordSize;
+                    break;
+
+                case WriteAddressRecordType:
+                    if (!CompleteWriteAddressRecord(ctx, buffer + offset))
+                    {
+                        return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+                    }
+
+                    offset += WriteAddressRecordSize;
+                    break;
+
+                default:
+                    TraceAmpr(ctx, "complete_unknown", commandBuffer, recordType, offset);
+                    return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+            }
+        }
+
+        TraceAmpr(ctx, "complete", commandBuffer, buffer, writeOffset);
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    private static bool InitializeCommandBuffer(
+        CpuContext ctx,
+        ulong commandBuffer,
+        ulong buffer,
+        ulong size,
+        ulong aux0,
+        ulong aux1,
+        bool clear)
+    {
+        if (clear)
+        {
+            Span<byte> header = stackalloc byte[CommandBufferHeaderSize];
+            header.Clear();
+            if (!ctx.Memory.TryWrite(commandBuffer, header))
+            {
+                return false;
+            }
+        }
+
+        return ctx.TryWriteUInt64(commandBuffer + CommandBufferSelfOffset, commandBuffer) &&
+               ctx.TryWriteUInt64(commandBuffer + CommandBufferAux0Offset, aux0) &&
+               ctx.TryWriteUInt64(commandBuffer + CommandBufferAux1Offset, aux1) &&
+               WriteCommandBufferPointers(ctx, commandBuffer, buffer, size, writeOffset: 0);
+    }
+
+    private static bool WriteCommandBufferPointers(CpuContext ctx, ulong commandBuffer, ulong buffer, ulong size)
+    {
+        return WriteCommandBufferPointers(ctx, commandBuffer, buffer, size, writeOffset: 0);
+    }
+
+    private static bool WriteCommandBufferPointers(CpuContext ctx, ulong commandBuffer, ulong buffer, ulong size, ulong writeOffset)
+    {
+        if (!WriteVisibleCommandBufferPointers(ctx, commandBuffer, buffer, size))
+        {
+            return false;
+        }
+
+        var state = _commandBuffers.GetOrAdd(commandBuffer, static _ => new CommandBufferState());
+        lock (state)
+        {
+            state.Buffer = buffer;
+            state.Size = size;
+            state.WriteOffset = writeOffset;
+        }
+
+        return true;
+    }
+
+    private static bool WriteVisibleCommandBufferPointers(CpuContext ctx, ulong commandBuffer, ulong buffer, ulong size)
+    {
+        return ctx.TryWriteUInt64(commandBuffer + CommandBufferSelfOffset, commandBuffer) &&
+               ctx.TryWriteUInt64(commandBuffer + CommandBufferDataOffset, buffer) &&
+               ctx.TryWriteUInt64(commandBuffer + CommandBufferSizeOffset, size);
+    }
+
+    private static bool TryGetCommandBufferState(
+        CpuContext ctx,
+        ulong commandBuffer,
+        out ulong buffer,
+        out ulong size,
+        out CommandBufferState? state)
+    {
+        if (_commandBuffers.TryGetValue(commandBuffer, out state))
+        {
+            lock (state)
+            {
+                buffer = state.Buffer;
+                size = state.Size;
+            }
+
+            return true;
+        }
+
+        if (ctx.TryReadUInt64(commandBuffer + CommandBufferDataOffset, out buffer) &&
+            ctx.TryReadUInt64(commandBuffer + CommandBufferSizeOffset, out size))
+        {
+            state = _commandBuffers.GetOrAdd(commandBuffer, static _ => new CommandBufferState());
+            lock (state)
+            {
+                state.Buffer = buffer;
+                state.Size = size;
+                state.WriteOffset = 0;
+            }
+
+            return true;
+        }
+
+        buffer = 0;
+        size = 0;
+        state = null;
+        return false;
+    }
+
+    private static bool TryGetCommandBufferOffset(CpuContext ctx, ulong commandBuffer, out ulong offset)
+    {
+        if (!TryGetCommandBufferState(ctx, commandBuffer, out _, out _, out var state) || state is null)
+        {
+            offset = 0;
+            return false;
+        }
+
+        lock (state)
+        {
+            offset = state.WriteOffset;
+        }
+
+        return true;
+    }
+
+    private static int TryReadFileToGuestMemory(
+        CpuContext ctx,
+        string hostPath,
+        ulong fileOffset,
+        ulong destination,
+        ulong size,
+        out ulong bytesRead)
+    {
+        bytesRead = 0;
+        if (size == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+        }
+
+        if (fileOffset > long.MaxValue)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        const int ChunkSize = 64 * 1024;
+        var buffer = new byte[(int)Math.Min((ulong)ChunkSize, size)];
+
+        try
+        {
+            using var stream = new FileStream(hostPath, FileMode.Open, FileAccess.Read, FileShare.ReadWrite | FileShare.Delete);
+            if (fileOffset >= (ulong)stream.Length)
+            {
+                return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+            }
+
+            stream.Position = unchecked((long)fileOffset);
+
+            while (bytesRead < size)
+            {
+                var request = (int)Math.Min((ulong)buffer.Length, size - bytesRead);
+                var read = stream.Read(buffer, 0, request);
+                if (read <= 0)
+                {
+                    break;
+                }
+
+                if (!ctx.Memory.TryWrite(destination + bytesRead, buffer.AsSpan(0, read)))
+                {
+                    return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+                }
+
+                bytesRead += (ulong)read;
+            }
+        }
+        catch (UnauthorizedAccessException)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_PERMISSION_DENIED;
+        }
+        catch (IOException)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    private static bool AppendReadFileRecord(
+        CpuContext ctx,
+        ulong commandBuffer,
+        uint fileId,
+        ulong destination,
+        ulong size,
+        ulong fileOffset,
+        ulong bytesRead)
+    {
+        Span<byte> record = stackalloc byte[(int)ReadFileRecordSize];
+        record.Clear();
+        BinaryPrimitives.WriteUInt32LittleEndian(record[0x00..], ReadFileRecordType);
+        BinaryPrimitives.WriteUInt32LittleEndian(record[0x04..], fileId);
+        BinaryPrimitives.WriteUInt64LittleEndian(record[0x08..], destination);
+        BinaryPrimitives.WriteUInt64LittleEndian(record[0x10..], size);
+        BinaryPrimitives.WriteUInt64LittleEndian(record[0x18..], fileOffset);
+        BinaryPrimitives.WriteUInt64LittleEndian(record[0x20..], bytesRead);
+
+        return AppendCommandBufferRecord(ctx, commandBuffer, record);
+    }
+
+    private static bool AppendKernelEventQueueRecord(
+        CpuContext ctx,
+        ulong commandBuffer,
+        ulong equeue,
+        ulong ident,
+        ulong filter,
+        ulong userData,
+        ulong data,
+        ulong extra)
+    {
+        Span<byte> record = stackalloc byte[(int)KernelEventQueueRecordSize];
+        record.Clear();
+        BinaryPrimitives.WriteUInt32LittleEndian(record[0x00..], KernelEventQueueRecordType);
+        BinaryPrimitives.WriteUInt32LittleEndian(record[0x04..], unchecked((uint)filter));
+        BinaryPrimitives.WriteUInt64LittleEndian(record[0x08..], equeue);
+        BinaryPrimitives.WriteUInt64LittleEndian(record[0x10..], ident);
+        BinaryPrimitives.WriteUInt64LittleEndian(record[0x18..], userData);
+        BinaryPrimitives.WriteUInt64LittleEndian(record[0x20..], data);
+        BinaryPrimitives.WriteUInt64LittleEndian(record[0x28..], extra);
+
+        return AppendCommandBufferRecord(ctx, commandBuffer, record);
+    }
+
+    private static bool AppendWriteAddressRecord(CpuContext ctx, ulong commandBuffer, ulong address, ulong value)
+    {
+        Span<byte> record = stackalloc byte[(int)WriteAddressRecordSize];
+        record.Clear();
+        BinaryPrimitives.WriteUInt32LittleEndian(record[0x00..], WriteAddressRecordType);
+        BinaryPrimitives.WriteUInt64LittleEndian(record[0x08..], address);
+        BinaryPrimitives.WriteUInt64LittleEndian(record[0x10..], value);
+
+        return AppendCommandBufferRecord(ctx, commandBuffer, record);
+    }
+
+    private static bool AppendCommandBufferRecord(CpuContext ctx, ulong commandBuffer, ReadOnlySpan<byte> record)
+    {
+        if (!TryGetCommandBufferState(ctx, commandBuffer, out _, out _, out var state) || state is null)
+        {
+            return false;
+        }
+
+        var recordSize = (ulong)record.Length;
+        lock (state)
+        {
+            if (state.Buffer == 0 ||
+                state.WriteOffset > state.Size ||
+                recordSize > state.Size - state.WriteOffset)
+            {
+                return false;
+            }
+
+            if (!ctx.Memory.TryWrite(state.Buffer + state.WriteOffset, record))
+            {
+                return false;
+            }
+
+            state.WriteOffset += recordSize;
+        }
+
+        return true;
+    }
+
+    private static bool CompleteKernelEventQueueRecord(CpuContext ctx, ulong recordAddress)
+    {
+        Span<byte> record = stackalloc byte[(int)KernelEventQueueRecordSize];
+        if (!ctx.Memory.TryRead(recordAddress, record))
+        {
+            return false;
+        }
+
+        var filter = unchecked((short)BinaryPrimitives.ReadUInt32LittleEndian(record[0x04..]));
+        var equeue = BinaryPrimitives.ReadUInt64LittleEndian(record[0x08..]);
+        var ident = BinaryPrimitives.ReadUInt64LittleEndian(record[0x10..]);
+        var userData = BinaryPrimitives.ReadUInt64LittleEndian(record[0x18..]);
+        var data = BinaryPrimitives.ReadUInt64LittleEndian(record[0x20..]);
+        var extra = BinaryPrimitives.ReadUInt64LittleEndian(record[0x28..]);
+
+        var queuedEvent = new KernelEventQueueCompatExports.KernelQueuedEvent(
+            ident,
+            filter,
+            0x20,
+            unchecked((uint)extra),
+            data,
+            userData);
+
+        _ = KernelEventQueueCompatExports.EnqueueEvent(equeue, queuedEvent);
+        TraceAmpr(ctx, "complete_equeue", equeue, ident, data);
+        return true;
+    }
+
+    private static bool CompleteWriteAddressRecord(CpuContext ctx, ulong recordAddress)
+    {
+        Span<byte> record = stackalloc byte[(int)WriteAddressRecordSize];
+        if (!ctx.Memory.TryRead(recordAddress, record))
+        {
+            return false;
+        }
+
+        var address = BinaryPrimitives.ReadUInt64LittleEndian(record[0x08..]);
+        var value = BinaryPrimitives.ReadUInt64LittleEndian(record[0x10..]);
+        if (!ctx.TryWriteUInt64(address, value))
+        {
+            return false;
+        }
+
+        TraceAmpr(ctx, "complete_write_address", address, value, 0);
+        return true;
+    }
+
+    private static bool TryReadUInt32(CpuContext ctx, ulong address, out uint value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(uint)];
+        if (!ctx.Memory.TryRead(address, buffer))
+        {
+            value = 0;
+            return false;
+        }
+
+        value = BinaryPrimitives.ReadUInt32LittleEndian(buffer);
+        return true;
+    }
+
+    private static void TraceAmpr(CpuContext ctx, string operation, ulong commandBuffer, ulong arg0, ulong arg1)
+    {
+        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_AMPR"), "1", StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        var returnRip = 0UL;
+        _ = ctx.TryReadUInt64(ctx[CpuRegister.Rsp], out returnRip);
+        Console.Error.WriteLine(
+            $"[LOADER][TRACE] ampr.{operation}: cmd=0x{commandBuffer:X16} arg0=0x{arg0:X16} arg1=0x{arg1:X16} ret=0x{returnRip:X16}");
+    }
+
+    private static void TraceAmprRead(
+        CpuContext ctx,
+        ulong commandBuffer,
+        uint fileId,
+        ulong destination,
+        ulong size,
+        ulong fileOffset,
+        ulong bytesRead,
+        string? hostPath,
+        int result)
+    {
+        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_AMPR"), "1", StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        var returnRip = 0UL;
+        _ = ctx.TryReadUInt64(ctx[CpuRegister.Rsp], out returnRip);
+        Console.Error.WriteLine(
+            $"[LOADER][TRACE] ampr.read_file: cmd=0x{commandBuffer:X16} id=0x{fileId:X8} dst=0x{destination:X16} size=0x{size:X16} offset=0x{fileOffset:X16} read=0x{bytesRead:X16} result=0x{result:X8} path='{hostPath ?? string.Empty}' ret=0x{returnRip:X16}");
+    }
+}
@@ -0,0 +1,40 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Collections.Concurrent;
+
+namespace SharpEmu.Libs.Ampr;
+
+internal static class AmprFileRegistry
+{
+    private static readonly ConcurrentDictionary<uint, string> _hostPathsById = new();
+
+    public static uint Register(string guestPath, string hostPath)
+    {
+        var id = ComputeFileId(guestPath);
+        _hostPathsById[id] = hostPath;
+        return id;
+    }
+
+    public static bool TryGetHostPath(uint id, out string hostPath)
+    {
+        return _hostPathsById.TryGetValue(id, out hostPath!);
+    }
+
+    private static uint ComputeFileId(string guestPath)
+    {
+        var bytes = System.Text.Encoding.UTF8.GetBytes(guestPath);
+
+        const uint offsetBasis = 2166136261;
+        const uint prime = 16777619;
+
+        var hash = offsetBasis;
+        foreach (var b in bytes)
+        {
+            hash ^= b;
+            hash *= prime;
+        }
+
+        return hash;
+    }
+}
@@ -2,11 +2,44 @@
 // SPDX-License-Identifier: GPL-2.0-or-later

 using SharpEmu.HLE;
+using System.Buffers.Binary;
+using System.Text;
+using System.Text.Json;

 namespace SharpEmu.Libs.AppContent;

 public static class AppContentExports
 {
+    private const ulong BootParamAttrOffset = 4;
+    private const string Temp0MountPoint = "/temp0";
+    private const uint AppParamSkuFlag = 0;
+    private const int AppParamSkuFlagFull = 3;
+
+    [SysAbiExport(
+        Nid = "R9lA82OraNs",
+        ExportName = "sceAppContentInitialize",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAppContent")]
+    public static int AppContentInitialize(CpuContext ctx)
+    {
+        var initParamAddress = ctx[CpuRegister.Rdi];
+        var bootParamAddress = ctx[CpuRegister.Rsi];
+        if (initParamAddress == 0 || bootParamAddress == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        Span<byte> attrBytes = stackalloc byte[sizeof(uint)];
+        BinaryPrimitives.WriteUInt32LittleEndian(attrBytes, 0);
+        if (!ctx.Memory.TryWrite(bootParamAddress + BootParamAttrOffset, attrBytes))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
    [SysAbiExport(
        Nid = "xnd8BJzAxmk",
        ExportName = "sceAppContentGetAddcontInfoList",
@@ -14,7 +47,165 @@ public static class AppContentExports
        LibraryName = "libSceAppContent")]
    public static int AppContentGetAddcontInfoList(CpuContext ctx)
    {
-        _ = ctx;
+        var hitCountAddress = ctx[CpuRegister.Rcx];
+        if (hitCountAddress != 0)
+        {
+            Span<byte> hitCountBytes = stackalloc byte[sizeof(uint)];
+            BinaryPrimitives.WriteUInt32LittleEndian(hitCountBytes, 0);
+            if (!ctx.Memory.TryWrite(hitCountAddress, hitCountBytes))
+            {
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+            }
+        }
+
+        ctx[CpuRegister.Rax] = 0;
        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
    }
+
+    [SysAbiExport(
+        Nid = "99b82IKXpH4",
+        ExportName = "sceAppContentAppParamGetInt",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAppContent")]
+    public static int AppContentAppParamGetInt(CpuContext ctx)
+    {
+        var paramId = (uint)ctx[CpuRegister.Rdi];
+        var valueAddress = ctx[CpuRegister.Rsi];
+        if (valueAddress == 0)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        int value;
+        if (paramId == AppParamSkuFlag)
+        {
+            value = AppParamSkuFlagFull;
+        }
+        else if (!TryReadUserDefinedParam(paramId, out value))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        Span<byte> valueBytes = stackalloc byte[sizeof(int)];
+        BinaryPrimitives.WriteInt32LittleEndian(valueBytes, value);
+        if (!ctx.Memory.TryWrite(valueAddress, valueBytes))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        TraceAppContent($"app_param_get_int id={paramId} value={value}");
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    [SysAbiExport(
+        Nid = "buYbeLOGWmA",
+        ExportName = "sceAppContentTemporaryDataMount2",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAppContent")]
+    public static int AppContentTemporaryDataMount2(CpuContext ctx)
+    {
+        var mountPointAddress = ctx[CpuRegister.Rsi];
+        if (mountPointAddress == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        Directory.CreateDirectory(ResolveTemp0Root());
+        var mountPointBytes = Encoding.ASCII.GetBytes($"{Temp0MountPoint}\0");
+        if (!ctx.Memory.TryWrite(mountPointAddress, mountPointBytes))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    private static bool TryReadUserDefinedParam(uint paramId, out int value)
+    {
+        value = 0;
+        if (paramId is < 1 or > 4)
+        {
+            return false;
+        }
+
+        var app0Root = Environment.GetEnvironmentVariable("SHARPEMU_APP0_DIR");
+        if (string.IsNullOrWhiteSpace(app0Root))
+        {
+            return true;
+        }
+
+        var paramJsonPath = Path.Combine(app0Root, "sce_sys", "param.json");
+        if (!File.Exists(paramJsonPath))
+        {
+            return true;
+        }
+
+        try
+        {
+            using var stream = File.OpenRead(paramJsonPath);
+            using var document = JsonDocument.Parse(stream);
+            var propertyName = $"userDefinedParam{paramId}";
+            if (document.RootElement.TryGetProperty(propertyName, out var element) &&
+                element.TryGetInt32(out var parsedValue))
+            {
+                value = parsedValue;
+            }
+
+            return true;
+        }
+        catch (IOException)
+        {
+            return true;
+        }
+        catch (UnauthorizedAccessException)
+        {
+            return true;
+        }
+        catch (JsonException)
+        {
+            return true;
+        }
+    }
+
+    private static int SetReturn(CpuContext ctx, OrbisGen2Result result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)(int)result);
+        return (int)result;
+    }
+
+    private static void TraceAppContent(string message)
+    {
+        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_APP_CONTENT"), "1", StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine($"[LOADER][TRACE] app_content.{message}");
+    }
+
+    private static string ResolveTemp0Root()
+    {
+        const string temp0VariableName = "SHARPEMU_TEMP0_DIR";
+        var configuredRoot = Environment.GetEnvironmentVariable(temp0VariableName);
+        if (!string.IsNullOrWhiteSpace(configuredRoot))
+        {
+            return Path.GetFullPath(configuredRoot);
+        }
+
+        var app0Root = Environment.GetEnvironmentVariable("SHARPEMU_APP0_DIR");
+        var appName = string.IsNullOrWhiteSpace(app0Root)
+            ? "default"
+            : Path.GetFileName(Path.TrimEndingDirectorySeparator(app0Root));
+        if (string.IsNullOrWhiteSpace(appName))
+        {
+            appName = "default";
+        }
+
+        var invalidChars = Path.GetInvalidFileNameChars();
+        appName = new string(appName.Select(ch => invalidChars.Contains(ch) ? '_' : ch).ToArray());
+        var root = Path.Combine(Path.GetTempPath(), "SharpEmu", appName, "temp0");
+        Environment.SetEnvironmentVariable(temp0VariableName, root);
+        return root;
+    }
 }
@@ -0,0 +1,38 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Threading;
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.CommonDialog;
+
+public static class CommonDialogExports
+{
+    private const int AlreadySystemInitialized = unchecked((int)0x80B80002);
+    private static int _initialized;
+
+    [SysAbiExport(
+        Nid = "uoUpLGNkygk",
+        ExportName = "sceCommonDialogInitialize",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceCommonDialog")]
+    public static int CommonDialogInitialize(CpuContext ctx)
+    {
+        var result = Interlocked.Exchange(ref _initialized, 1) == 0
+            ? 0
+            : AlreadySystemInitialized;
+        ctx[CpuRegister.Rax] = unchecked((ulong)result);
+        return result;
+    }
+
+    [SysAbiExport(
+        Nid = "BQ3tey0JmQM",
+        ExportName = "sceCommonDialogIsUsed",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceCommonDialog")]
+    public static int CommonDialogIsUsed(CpuContext ctx)
+    {
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+}
@@ -10,9 +10,14 @@ namespace SharpEmu.Libs.CxxAbi;

 public static class CxaGuardExports
 {
+    private const ulong GuardCompleteValue = 0x0000_0000_0000_0001;
+    private const ulong GuardPendingValue = 0x0000_0000_0000_0100;
+    private const ulong GuardStateMask = 0x0000_0000_0000_FFFF;
+
    private sealed class GuardState
    {
        public int OwnerThreadId { get; set; }
+        public int RecursionDepth { get; set; }
    }

    private static readonly ConcurrentDictionary<ulong, GuardState> _inProgress = new();
@@ -35,13 +40,13 @@ public static class CxaGuardExports
        var spinner = new SpinWait();
        while (true)
        {
-            if (!TryReadGuardInitialized(ctx, guardPtr, out var initialized))
+            if (!TryReadGuardState(ctx, guardPtr, out _, out var initialized, out var inProgress))
            {
                ctx[CpuRegister.Rax] = 0;
                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
            }

-            LogGuardState(ctx, "guard_acquire", guardPtr, initialized);
+            LogGuardState(ctx, "guard_acquire", guardPtr, initialized, inProgress);

            if (initialized)
            {
@@ -53,9 +58,17 @@ public static class CxaGuardExports
            var newState = new GuardState
            {
                OwnerThreadId = currentThreadId,
+                RecursionDepth = 1,
            };
            if (_inProgress.TryAdd(guardPtr, newState))
            {
+                if (!TryWriteGuardState(ctx, guardPtr, GuardPendingValue))
+                {
+                    _inProgress.TryRemove(guardPtr, out _);
+                    ctx[CpuRegister.Rax] = 0;
+                    return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+                }
+
                ctx[CpuRegister.Rax] = 1;
                LogGuardResult("guard_acquire", guardPtr, result: 1, initialized, inProgress: true, ownerThreadId: currentThreadId);
                return (int)OrbisGen2Result.ORBIS_GEN2_OK;
@@ -101,14 +114,28 @@ public static class CxaGuardExports
            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
        }

-        if (!TryWriteGuardInitialized(ctx, guardPtr, initialized: true))
+        if (state is not null)
+        {
+            lock (state)
+            {
+                if (state.RecursionDepth > 1)
+                {
+                    state.RecursionDepth--;
+                    ctx[CpuRegister.Rax] = 0;
+                    LogGuardResult("guard_release", guardPtr, result: 0, initialized: false, inProgress: true, ownerThreadId: state.OwnerThreadId);
+                    return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+                }
+            }
+        }
+
+        if (!TryWriteGuardState(ctx, guardPtr, GuardCompleteValue))
        {
            ctx[CpuRegister.Rax] = 0;
            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
        }

        _inProgress.TryRemove(guardPtr, out _);
-        LogGuardState(ctx, "guard_release", guardPtr, initialized: true);
+        LogGuardState(ctx, "guard_release", guardPtr, initialized: true, inProgress: false);

        ctx[CpuRegister.Rax] = 0;
        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
@@ -136,60 +163,50 @@ public static class CxaGuardExports
            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
        }

-        _ = TryWriteGuardInitialized(ctx, guardPtr, initialized: false);
+        _ = TryWriteGuardState(ctx, guardPtr, 0);
        _inProgress.TryRemove(guardPtr, out _);
-        LogGuardState(ctx, "guard_abort", guardPtr, initialized: false);
+        LogGuardState(ctx, "guard_abort", guardPtr, initialized: false, inProgress: false);

        ctx[CpuRegister.Rax] = 0;
        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
    }

-    private static bool TryReadGuardInitialized(CpuContext ctx, ulong guardPtr, out bool initialized)
+    private static bool TryReadGuardState(CpuContext ctx, ulong guardPtr, out ulong word, out bool initialized, out bool inProgress)
    {
+        word = 0;
        initialized = false;
-
-        var aligned = guardPtr & ~7UL;
-        var shift = (int)((guardPtr & 7UL) * 8);
-
-        if (!ctx.TryReadUInt64(aligned, out var word))
+        inProgress = false;
+        if (!ctx.TryReadUInt64(guardPtr, out word))
        {
            return false;
        }

-        var b0 = (byte)((word >> shift) & 0xFF);
-        initialized = (b0 & 0x01) != 0;
+        initialized = (word & GuardCompleteValue) != 0;
+        inProgress = (word & 0x0000_0000_0000_FF00) != 0;
        return true;
    }

-    private static bool TryWriteGuardInitialized(CpuContext ctx, ulong guardPtr, bool initialized)
+    private static bool TryWriteGuardState(CpuContext ctx, ulong guardPtr, ulong stateValue)
    {
-        var aligned = guardPtr & ~7UL;
-        var shift = (int)((guardPtr & 7UL) * 8);
-        var mask = 0xFFUL << shift;
-
-        if (!ctx.TryReadUInt64(aligned, out var word))
+        if (!ctx.TryReadUInt64(guardPtr, out var word))
        {
            return false;
        }

-        var b0 = (byte)((word >> shift) & 0xFF);
-        b0 = initialized ? (byte)(b0 | 0x01) : (byte)(b0 & ~0x01);
-
-        var newWord = (word & ~mask) | ((ulong)b0 << shift);
-        return ctx.TryWriteUInt64(aligned, newWord);
+        var newWord = (word & ~GuardStateMask) | (stateValue & GuardStateMask);
+        return ctx.TryWriteUInt64(guardPtr, newWord);
    }

-    private static void LogGuardState(CpuContext ctx, string op, ulong guardPtr, bool initialized)
+    private static void LogGuardState(CpuContext ctx, string op, ulong guardPtr, bool initialized, bool inProgress)
    {
        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_GUARDS"), "1", StringComparison.Ordinal))
        {
            return;
        }

-        var aligned = guardPtr & ~7UL;
-        var readable = ctx.TryReadUInt64(aligned, out var word);
+        var readable = ctx.TryReadUInt64(guardPtr, out var word);
        Console.Error.WriteLine(
-            $"[LOADER][TRACE] {op}: guard=0x{guardPtr:X16} aligned=0x{aligned:X16} init={initialized} word={(readable ? $"0x{word:X16}" : "<unreadable>")}");
+            $"[LOADER][TRACE] {op}: guard=0x{guardPtr:X16} init={initialized} in_progress={inProgress} word={(readable ? $"0x{word:X16}" : "<unreadable>")}");
    }

    private static void LogGuardResult(string op, ulong guardPtr, int result, bool initialized, bool inProgress, int ownerThreadId)
@@ -0,0 +1,24 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Threading;
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.GameUpdate;
+
+public static class GameUpdateExports
+{
+    private static int _initialized;
+
+    [SysAbiExport(
+        Nid = "YJtKLttI9fM",
+        ExportName = "sceGameUpdateInitialize",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceGameUpdate")]
+    public static int GameUpdateInitialize(CpuContext ctx)
+    {
+        Interlocked.Exchange(ref _initialized, 1);
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+}
@@ -0,0 +1,91 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System;
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.Json;
+
+public static class JsonExports
+{
+    [SysAbiExport(
+        Nid = "-hJRce8wn1U",
+        ExportName = "_ZN3sce4Json12MemAllocatorC2Ev",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceJson")]
+    public static int MemAllocatorConstructor(CpuContext ctx)
+    {
+        var thisAddress = ctx[CpuRegister.Rdi];
+        TraceJson("MemAllocator.ctor", thisAddress, 0);
+        ctx[CpuRegister.Rax] = thisAddress;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "OcAgPxcq5Vk",
+        ExportName = "_ZN3sce4Json12MemAllocatorD2Ev",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceJson")]
+    public static int MemAllocatorDestructor(CpuContext ctx)
+    {
+        TraceJson("MemAllocator.dtor", ctx[CpuRegister.Rdi], 0);
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "cK6bYHf-Q5E",
+        ExportName = "_ZN3sce4Json11InitializerC1Ev",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceJson")]
+    public static int InitializerConstructor(CpuContext ctx)
+    {
+        var thisAddress = ctx[CpuRegister.Rdi];
+        TraceJson("Initializer.ctor", thisAddress, 0);
+        ctx[CpuRegister.Rax] = thisAddress;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "RujUxbr3haM",
+        ExportName = "_ZN3sce4Json11InitializerD1Ev",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceJson")]
+    public static int InitializerDestructor(CpuContext ctx)
+    {
+        TraceJson("Initializer.dtor", ctx[CpuRegister.Rdi], 0);
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "Cxwy7wHq4J0",
+        ExportName = "_ZN3sce4Json11Initializer10initializeEPKNS0_13InitParameterE",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceJson")]
+    public static int InitializerInitialize(CpuContext ctx)
+    {
+        var thisAddress = ctx[CpuRegister.Rdi];
+        var initParameterAddress = ctx[CpuRegister.Rsi];
+        if (thisAddress == 0)
+        {
+            ctx[CpuRegister.Rax] = unchecked((ulong)(int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        TraceJson("Initializer.initialize", thisAddress, initParameterAddress);
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    private static void TraceJson(string operation, ulong thisAddress, ulong argument)
+    {
+        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_JSON"), "1", StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine(
+            $"[LOADER][TRACE] json.{operation} this=0x{thisAddress:X16} arg=0x{argument:X16}");
+    }
+}
@@ -0,0 +1,184 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+using SharpEmu.Libs.Ampr;
+using System.Buffers.Binary;
+using System.Collections.Concurrent;
+using System.Threading;
+
+namespace SharpEmu.Libs.Kernel;
+
+public static class KernelAprCompatExports
+{
+    private static readonly ConcurrentDictionary<uint, ulong> _submittedCommandBuffers = new();
+    private static int _nextSubmissionId;
+
+    [SysAbiExport(
+        Nid = "ASoW5WE-UPo",
+        ExportName = "sceKernelAprSubmitCommandBufferAndGetResult",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelAprSubmitCommandBufferAndGetResult(CpuContext ctx)
+    {
+        var commandBuffer = ctx[CpuRegister.Rdi];
+        var priority = ctx[CpuRegister.Rsi];
+        var resultAddress = ctx[CpuRegister.Rdx];
+        var outSubmissionId = ctx[CpuRegister.Rcx];
+
+        if (commandBuffer == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        var submissionId = unchecked((uint)Interlocked.Increment(ref _nextSubmissionId));
+        if (submissionId == 0)
+        {
+            submissionId = unchecked((uint)Interlocked.Increment(ref _nextSubmissionId));
+        }
+
+        _submittedCommandBuffers[submissionId] = commandBuffer;
+
+        var completionResult = AmprExports.CompleteCommandBuffer(ctx, commandBuffer);
+        if (completionResult != (int)OrbisGen2Result.ORBIS_GEN2_OK)
+        {
+            return completionResult;
+        }
+
+        if (outSubmissionId != 0 && !TryWriteUInt32(ctx, outSubmissionId, submissionId))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        if (resultAddress != 0 && !TryWriteAprResult(ctx, resultAddress))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        TraceApr(ctx, "submit_get_result", submissionId, commandBuffer, priority, resultAddress);
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "rqwFKI4PAiM",
+        ExportName = "sceKernelAprWaitCommandBuffer",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelAprWaitCommandBuffer(CpuContext ctx)
+    {
+        var submissionId = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var priority = ctx[CpuRegister.Rsi];
+        var resultAddress = ctx[CpuRegister.Rdx];
+
+        if (!_submittedCommandBuffers.TryRemove(submissionId, out var commandBuffer))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+        }
+
+        if (resultAddress != 0 && !TryWriteAprResult(ctx, resultAddress))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        TraceApr(ctx, "wait", submissionId, commandBuffer, priority, resultAddress);
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "eE4Szl8sil8",
+        ExportName = "sceKernelAprSubmitCommandBuffer",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelAprSubmitCommandBuffer(CpuContext ctx)
+    {
+        var commandBuffer = ctx[CpuRegister.Rdi];
+        if (commandBuffer == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        var submissionId = unchecked((uint)Interlocked.Increment(ref _nextSubmissionId));
+        _submittedCommandBuffers[submissionId] = commandBuffer;
+
+        var completionResult = AmprExports.CompleteCommandBuffer(ctx, commandBuffer);
+        if (completionResult != (int)OrbisGen2Result.ORBIS_GEN2_OK)
+        {
+            return completionResult;
+        }
+
+        TraceApr(ctx, "submit", submissionId, commandBuffer, ctx[CpuRegister.Rsi], 0);
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "qvMUCyyaCSI",
+        ExportName = "sceKernelAprSubmitCommandBufferAndGetId",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelAprSubmitCommandBufferAndGetId(CpuContext ctx)
+    {
+        var commandBuffer = ctx[CpuRegister.Rdi];
+        var outSubmissionId = ctx[CpuRegister.Rdx];
+        if (commandBuffer == 0 || outSubmissionId == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        var submissionId = unchecked((uint)Interlocked.Increment(ref _nextSubmissionId));
+        _submittedCommandBuffers[submissionId] = commandBuffer;
+
+        var completionResult = AmprExports.CompleteCommandBuffer(ctx, commandBuffer);
+        if (completionResult != (int)OrbisGen2Result.ORBIS_GEN2_OK)
+        {
+            return completionResult;
+        }
+
+        if (!TryWriteUInt32(ctx, outSubmissionId, submissionId))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        TraceApr(ctx, "submit_get_id", submissionId, commandBuffer, ctx[CpuRegister.Rsi], outSubmissionId);
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    private static bool TryWriteAprResult(CpuContext ctx, ulong resultAddress)
+    {
+        Span<byte> result = stackalloc byte[sizeof(ulong)];
+        result.Clear();
+        return ctx.Memory.TryWrite(resultAddress, result);
+    }
+
+    private static bool TryWriteUInt32(CpuContext ctx, ulong address, uint value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(uint)];
+        BinaryPrimitives.WriteUInt32LittleEndian(buffer, value);
+        return ctx.Memory.TryWrite(address, buffer);
+    }
+
+    private static void TraceApr(
+        CpuContext ctx,
+        string operation,
+        uint submissionId,
+        ulong commandBuffer,
+        ulong priority,
+        ulong aux)
+    {
+        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_AMPR"), "1", StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        var returnRip = 0UL;
+        _ = ctx.TryReadUInt64(ctx[CpuRegister.Rsp], out returnRip);
+        Console.Error.WriteLine(
+            $"[LOADER][TRACE] apr.{operation}: id=0x{submissionId:X8} cmd=0x{commandBuffer:X16} priority=0x{priority:X16} aux=0x{aux:X16} ret=0x{returnRip:X16}");
+        if (aux != 0 &&
+            ctx.TryReadUInt64(aux, out var result0) &&
+            ctx.TryReadUInt64(aux + sizeof(ulong), out var result1))
+        {
+            Console.Error.WriteLine(
+                $"[LOADER][TRACE] apr.{operation}.result: addr=0x{aux:X16} q0=0x{result0:X16} q1=0x{result1:X16}");
+        }
+    }
+}
@@ -0,0 +1,579 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Buffers.Binary;
+using System.Collections.Concurrent;
+using System.Text;
+using SharpEmu.HLE;
+using SharpEmu.Libs.Fiber;
+
+namespace SharpEmu.Libs.Kernel;
+
+public static class KernelEventFlagCompatExports
+{
+    private const int MaxEventFlagNameLength = 31;
+    private const int HostWaitPumpMilliseconds = 1;
+    private const uint AttrThreadFifo = 0x01;
+    private const uint AttrThreadPriority = 0x02;
+    private const uint AttrSingle = 0x10;
+    private const uint AttrMulti = 0x20;
+    private const uint WaitAnd = 0x01;
+    private const uint WaitOr = 0x02;
+    private const uint ClearAll = 0x10;
+    private const uint ClearPattern = 0x20;
+
+    private static readonly ConcurrentDictionary<ulong, EventFlagState> _eventFlags = new();
+    private static long _nextEventFlagHandle = 1;
+
+    private sealed class EventFlagState
+    {
+        public required string Name { get; init; }
+        public required uint Attributes { get; init; }
+        public ulong Bits { get; set; }
+        public int WaitingThreads { get; set; }
+        public object Gate { get; } = new();
+    }
+
+    [SysAbiExport(
+        Nid = "BpFoboUJoZU",
+        ExportName = "sceKernelCreateEventFlag",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelCreateEventFlag(CpuContext ctx)
+    {
+        var outAddress = ctx[CpuRegister.Rdi];
+        var nameAddress = ctx[CpuRegister.Rsi];
+        var attributes = unchecked((uint)ctx[CpuRegister.Rdx]);
+        var initialPattern = ctx[CpuRegister.Rcx];
+        var optionAddress = ctx[CpuRegister.R8];
+
+        if (outAddress == 0 ||
+            nameAddress == 0 ||
+            optionAddress != 0 ||
+            !IsValidAttributes(attributes))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        if (!TryReadNullTerminatedUtf8(ctx, nameAddress, MaxEventFlagNameLength + 1, out var name))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        if (Encoding.UTF8.GetByteCount(name) > MaxEventFlagNameLength)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        var handle = unchecked((ulong)Interlocked.Increment(ref _nextEventFlagHandle));
+        _eventFlags[handle] = new EventFlagState
+        {
+            Name = name,
+            Attributes = attributes,
+            Bits = initialPattern,
+        };
+
+        if (!ctx.TryWriteUInt64(outAddress, handle))
+        {
+            _eventFlags.TryRemove(handle, out _);
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        TraceEventFlag($"create handle=0x{handle:X16} name='{name}' attr=0x{attributes:X2} bits=0x{initialPattern:X16}");
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    [SysAbiExport(
+        Nid = "8mql9OcQnd4",
+        ExportName = "sceKernelDeleteEventFlag",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelDeleteEventFlag(CpuContext ctx)
+    {
+        var handle = ctx[CpuRegister.Rdi];
+        if (!_eventFlags.TryRemove(handle, out var state))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND);
+        }
+
+        lock (state.Gate)
+        {
+            Monitor.PulseAll(state.Gate);
+        }
+
+        TraceEventFlag($"delete handle=0x{handle:X16} name='{state.Name}'");
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    [SysAbiExport(
+        Nid = "IOnSvHzqu6A",
+        ExportName = "sceKernelSetEventFlag",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelSetEventFlag(CpuContext ctx)
+    {
+        var handle = ctx[CpuRegister.Rdi];
+        var pattern = ctx[CpuRegister.Rsi];
+        var returnRip = GetCurrentReturnRip();
+        if (!_eventFlags.TryGetValue(handle, out var state))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND);
+        }
+
+        lock (state.Gate)
+        {
+            state.Bits |= pattern;
+            Monitor.PulseAll(state.Gate);
+            TraceEventFlag($"set handle=0x{handle:X16} pattern=0x{pattern:X16} bits=0x{state.Bits:X16} ret=0x{returnRip:X16}");
+        }
+
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    [SysAbiExport(
+        Nid = "7uhBFWRAS60",
+        ExportName = "sceKernelClearEventFlag",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelClearEventFlag(CpuContext ctx)
+    {
+        var handle = ctx[CpuRegister.Rdi];
+        var pattern = ctx[CpuRegister.Rsi];
+        if (!_eventFlags.TryGetValue(handle, out var state))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND);
+        }
+
+        lock (state.Gate)
+        {
+            state.Bits &= pattern;
+            TraceEventFlag($"clear handle=0x{handle:X16} mask=0x{pattern:X16} bits=0x{state.Bits:X16}");
+        }
+
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    [SysAbiExport(
+        Nid = "9lvj5DjHZiA",
+        ExportName = "sceKernelPollEventFlag",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelPollEventFlag(CpuContext ctx)
+    {
+        var handle = ctx[CpuRegister.Rdi];
+        var pattern = ctx[CpuRegister.Rsi];
+        var waitMode = unchecked((uint)ctx[CpuRegister.Rdx]);
+        var resultAddress = ctx[CpuRegister.Rcx];
+
+        if (!_eventFlags.TryGetValue(handle, out var state))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND);
+        }
+
+        if (pattern == 0 || !IsValidWaitMode(waitMode))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        lock (state.Gate)
+        {
+            if (!TryWriteResultPattern(ctx, resultAddress, state.Bits))
+            {
+                return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+            }
+
+            if (!IsSatisfied(state.Bits, pattern, waitMode))
+            {
+                return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_BUSY);
+            }
+
+            ApplyClearMode(state, pattern, waitMode);
+            TraceEventFlag($"poll handle=0x{handle:X16} pattern=0x{pattern:X16} mode=0x{waitMode:X2} bits=0x{state.Bits:X16}");
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+        }
+    }
+
+    [SysAbiExport(
+        Nid = "JTvBflhYazQ",
+        ExportName = "sceKernelWaitEventFlag",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelWaitEventFlag(CpuContext ctx)
+    {
+        var handle = ctx[CpuRegister.Rdi];
+        var pattern = ctx[CpuRegister.Rsi];
+        var waitMode = unchecked((uint)ctx[CpuRegister.Rdx]);
+        var resultAddress = ctx[CpuRegister.Rcx];
+        var timeoutAddress = ctx[CpuRegister.R8];
+        var returnRip = GetCurrentReturnRip();
+
+        if (!_eventFlags.TryGetValue(handle, out var state))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND);
+        }
+
+        if (pattern == 0 || !IsValidWaitMode(waitMode))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        uint timeoutUsec = 0;
+        if (timeoutAddress != 0 && !TryReadUInt32(ctx, timeoutAddress, out timeoutUsec))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        Monitor.Enter(state.Gate);
+        try
+        {
+            if (TryCompleteSatisfiedWait(ctx, state, pattern, waitMode, out var immediateWaitResult))
+            {
+                return SetReturn(ctx, immediateWaitResult);
+            }
+
+            if (timeoutAddress != 0)
+            {
+                _ = TryWriteUInt32(ctx, timeoutAddress, 0);
+                _ = TryWriteResultPattern(ctx, resultAddress, state.Bits);
+                TraceEventFlag($"wait-timeout handle=0x{handle:X16} pattern=0x{pattern:X16} timeout={timeoutUsec} ret=0x{returnRip:X16}");
+                return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_TIMED_OUT);
+            }
+
+            var currentGuestThread = GuestThreadExecution.CurrentGuestThreadHandle;
+            var currentFiber = FiberExports.GetCurrentFiberAddressForDiagnostics(ctx);
+            var managedThread = Environment.CurrentManagedThreadId;
+            var requestedBlock = GuestThreadExecution.RequestCurrentThreadBlock("sceKernelWaitEventFlag");
+            TraceEventFlag($"wait-unsatisfied handle=0x{handle:X16} pattern=0x{pattern:X16} bits=0x{state.Bits:X16} guest_thread=0x{currentGuestThread:X16} fiber=0x{currentFiber:X16} managed={managedThread} block={requestedBlock} ret=0x{returnRip:X16} frames={FormatFrameChain(ctx)}");
+            TraceEventFlag($"wait-object handle=0x{handle:X16} name='{state.Name}' {FormatGuestWaitObject(ctx)}");
+            if (!requestedBlock)
+            {
+                var scheduler = GuestThreadExecution.Scheduler;
+                if (scheduler is null)
+                {
+                    return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_TRY_AGAIN);
+                }
+
+                state.WaitingThreads++;
+                TraceEventFlag($"wait-pump handle=0x{handle:X16} pattern=0x{pattern:X16} waiters={state.WaitingThreads} guest_thread=0x{currentGuestThread:X16} fiber=0x{currentFiber:X16} managed={managedThread} ret=0x{returnRip:X16}");
+                var releaseWaiter = true;
+                try
+                {
+                    while (true)
+                    {
+                        Monitor.Exit(state.Gate);
+                        try
+                        {
+                            scheduler.Pump(ctx, "sceKernelWaitEventFlag");
+                        }
+                        finally
+                        {
+                            Monitor.Enter(state.Gate);
+                        }
+
+                        if (TryCompleteSatisfiedWait(ctx, state, pattern, waitMode, out var pumpedWaitResult))
+                        {
+                            state.WaitingThreads = Math.Max(0, state.WaitingThreads - 1);
+                            releaseWaiter = false;
+                            TraceEventFlag($"wait-wake handle=0x{handle:X16} pattern=0x{pattern:X16} bits=0x{state.Bits:X16} waiters={state.WaitingThreads} ret=0x{returnRip:X16}");
+                            return SetReturn(ctx, pumpedWaitResult);
+                        }
+
+                        Monitor.Wait(state.Gate, HostWaitPumpMilliseconds);
+                    }
+                }
+                finally
+                {
+                    if (releaseWaiter)
+                    {
+                        state.WaitingThreads = Math.Max(0, state.WaitingThreads - 1);
+                    }
+                }
+            }
+
+            state.WaitingThreads++;
+            TraceEventFlag($"wait-block handle=0x{handle:X16} pattern=0x{pattern:X16} waiters={state.WaitingThreads} guest_thread=0x{currentGuestThread:X16} fiber=0x{currentFiber:X16} managed={managedThread} ret=0x{returnRip:X16}");
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+        }
+        finally
+        {
+            Monitor.Exit(state.Gate);
+        }
+    }
+
+    [SysAbiExport(
+        Nid = "PZku4ZrXJqg",
+        ExportName = "sceKernelCancelEventFlag",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelCancelEventFlag(CpuContext ctx)
+    {
+        var handle = ctx[CpuRegister.Rdi];
+        var setPattern = ctx[CpuRegister.Rsi];
+        var waiterCountAddress = ctx[CpuRegister.Rdx];
+        if (!_eventFlags.TryGetValue(handle, out var state))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND);
+        }
+
+        lock (state.Gate)
+        {
+            if (waiterCountAddress != 0 &&
+                !TryWriteUInt32(ctx, waiterCountAddress, unchecked((uint)state.WaitingThreads)))
+            {
+                return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+            }
+
+            state.Bits = setPattern;
+            state.WaitingThreads = 0;
+            Monitor.PulseAll(state.Gate);
+            TraceEventFlag($"cancel handle=0x{handle:X16} bits=0x{setPattern:X16}");
+        }
+
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    private static bool IsValidAttributes(uint attributes)
+    {
+        var queueMode = attributes & 0x0F;
+        var threadMode = attributes & 0xF0;
+        return (queueMode is 0 or AttrThreadFifo or AttrThreadPriority) &&
+            (threadMode is 0 or AttrSingle or AttrMulti) &&
+            (attributes & ~0x33u) == 0;
+    }
+
+    private static bool IsValidWaitMode(uint waitMode)
+    {
+        var condition = waitMode & 0x0F;
+        var clearMode = waitMode & 0xF0;
+        return condition is WaitAnd or WaitOr &&
+            clearMode is 0 or ClearAll or ClearPattern &&
+            (waitMode & ~0x33u) == 0;
+    }
+
+    private static bool IsSatisfied(ulong bits, ulong pattern, uint waitMode) =>
+        (waitMode & 0x0F) == WaitAnd
+            ? (bits & pattern) == pattern
+            : (bits & pattern) != 0;
+
+    private static void ApplyClearMode(EventFlagState state, ulong pattern, uint waitMode)
+    {
+        switch (waitMode & 0xF0)
+        {
+            case ClearAll:
+                state.Bits = 0;
+                break;
+            case ClearPattern:
+                state.Bits &= ~pattern;
+                break;
+        }
+    }
+
+    private static bool TryCompleteSatisfiedWait(
+        CpuContext ctx,
+        EventFlagState state,
+        ulong pattern,
+        uint waitMode,
+        out OrbisGen2Result result)
+    {
+        result = OrbisGen2Result.ORBIS_GEN2_OK;
+        if (!IsSatisfied(state.Bits, pattern, waitMode))
+        {
+            return false;
+        }
+
+        if (!TryWriteResultPattern(ctx, ctx[CpuRegister.Rcx], state.Bits))
+        {
+            result = OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+            return true;
+        }
+
+        ApplyClearMode(state, pattern, waitMode);
+        return true;
+    }
+
+    private static bool TryWriteResultPattern(CpuContext ctx, ulong address, ulong bits) =>
+        address == 0 || ctx.TryWriteUInt64(address, bits);
+
+    private static bool TryReadUInt32(CpuContext ctx, ulong address, out uint value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(uint)];
+        if (!ctx.Memory.TryRead(address, buffer))
+        {
+            value = 0;
+            return false;
+        }
+
+        value = BinaryPrimitives.ReadUInt32LittleEndian(buffer);
+        return true;
+    }
+
+    private static bool TryReadUInt64(CpuContext ctx, ulong address, out ulong value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(ulong)];
+        if (!ctx.Memory.TryRead(address, buffer))
+        {
+            value = 0;
+            return false;
+        }
+
+        value = BinaryPrimitives.ReadUInt64LittleEndian(buffer);
+        return true;
+    }
+
+    private static bool TryReadByte(CpuContext ctx, ulong address, out byte value)
+    {
+        Span<byte> buffer = stackalloc byte[1];
+        if (!ctx.Memory.TryRead(address, buffer))
+        {
+            value = 0;
+            return false;
+        }
+
+        value = buffer[0];
+        return true;
+    }
+
+    private static bool TryWriteUInt32(CpuContext ctx, ulong address, uint value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(uint)];
+        BinaryPrimitives.WriteUInt32LittleEndian(buffer, value);
+        return ctx.Memory.TryWrite(address, buffer);
+    }
+
+    private static bool TryReadNullTerminatedUtf8(CpuContext ctx, ulong address, int capacity, out string value)
+    {
+        var bytes = new byte[capacity];
+        for (var index = 0; index < bytes.Length; index++)
+        {
+            Span<byte> current = stackalloc byte[1];
+            if (!ctx.Memory.TryRead(address + (ulong)index, current))
+            {
+                value = string.Empty;
+                return false;
+            }
+
+            if (current[0] == 0)
+            {
+                value = Encoding.UTF8.GetString(bytes, 0, index);
+                return true;
+            }
+
+            bytes[index] = current[0];
+        }
+
+        value = Encoding.UTF8.GetString(bytes);
+        return true;
+    }
+
+    private static int SetReturn(CpuContext ctx, OrbisGen2Result result)
+    {
+        var value = (int)result;
+        ctx[CpuRegister.Rax] = unchecked((ulong)value);
+        return value;
+    }
+
+    private static void TraceEventFlag(string message)
+    {
+        if (string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_EVENT_FLAG"), "1", StringComparison.Ordinal))
+        {
+            Console.Error.WriteLine($"[LOADER][TRACE] event_flag.{message}");
+        }
+    }
+
+    private static ulong GetCurrentReturnRip() =>
+        GuestThreadExecution.TryGetCurrentImportCallFrame(out var frame)
+            ? frame.ReturnRip
+            : 0UL;
+
+    private static string FormatFrameChain(CpuContext ctx)
+    {
+        Span<ulong> returns = stackalloc ulong[4];
+        var count = 0;
+        var frame = ctx[CpuRegister.Rbp];
+        for (var index = 0; index < returns.Length && frame != 0; index++)
+        {
+            if (!ctx.TryReadUInt64(frame, out var nextFrame) ||
+                !ctx.TryReadUInt64(frame + sizeof(ulong), out var returnAddress))
+            {
+                break;
+            }
+
+            returns[count++] = returnAddress;
+            if (nextFrame <= frame)
+            {
+                break;
+            }
+
+            frame = nextFrame;
+        }
+
+        return count switch
+        {
+            0 => "none",
+            1 => $"0x{returns[0]:X16}",
+            2 => $"0x{returns[0]:X16},0x{returns[1]:X16}",
+            3 => $"0x{returns[0]:X16},0x{returns[1]:X16},0x{returns[2]:X16}",
+            _ => $"0x{returns[0]:X16},0x{returns[1]:X16},0x{returns[2]:X16},0x{returns[3]:X16}",
+        };
+    }
+
+    private static string FormatGuestWaitObject(CpuContext ctx)
+    {
+        var r12 = ctx[CpuRegister.R12];
+        var r13 = ctx[CpuRegister.R13];
+        var objectAddress = r12 != 0
+            ? r12
+            : r13 >= 0xA8
+                ? r13 - 0xA8
+                : 0;
+
+        var builder = new StringBuilder(256);
+        builder.Append($"r12=0x{r12:X16} r13=0x{r13:X16}");
+        if (objectAddress == 0)
+        {
+            return builder.ToString();
+        }
+
+        builder.Append($" obj=0x{objectAddress:X16}");
+        AppendUInt32(builder, ctx, objectAddress + 0x58, "o58");
+        AppendUInt32(builder, ctx, objectAddress + 0x5C, "o5C");
+        AppendUInt64(builder, ctx, objectAddress + 0x60, "o60");
+        AppendByte(builder, ctx, objectAddress + 0x6C, "state6C");
+        AppendByte(builder, ctx, objectAddress + 0x6D, "o6D");
+        AppendByte(builder, ctx, objectAddress + 0xA0, "waitA0");
+        AppendByte(builder, ctx, objectAddress + 0xA1, "stateA1");
+        AppendByte(builder, ctx, objectAddress + 0xA2, "oA2");
+        AppendUInt64(builder, ctx, objectAddress + 0xA8, "eventA8");
+        if (r13 != 0)
+        {
+            AppendUInt64(builder, ctx, r13, "r13_0");
+            AppendUInt64(builder, ctx, r13 + 8, "r13_8");
+        }
+
+        return builder.ToString();
+    }
+
+    private static void AppendByte(StringBuilder builder, CpuContext ctx, ulong address, string name)
+    {
+        if (TryReadByte(ctx, address, out var value))
+        {
+            builder.Append($" {name}=0x{value:X2}");
+        }
+    }
+
+    private static void AppendUInt32(StringBuilder builder, CpuContext ctx, ulong address, string name)
+    {
+        if (TryReadUInt32(ctx, address, out var value))
+        {
+            builder.Append($" {name}=0x{value:X8}");
+        }
+    }
+
+    private static void AppendUInt64(StringBuilder builder, CpuContext ctx, ulong address, string name)
+    {
+        if (TryReadUInt64(ctx, address, out var value))
+        {
+            builder.Append($" {name}=0x{value:X16}");
+        }
+    }
+}
@@ -0,0 +1,362 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+using System.Buffers.Binary;
+using System.Threading;
+
+namespace SharpEmu.Libs.Kernel;
+
+public static class KernelEventQueueCompatExports
+{
+    private const int KernelEventSize = 0x20;
+
+    private static readonly object _eventQueueGate = new();
+    private static readonly HashSet<ulong> _eventQueues = new();
+    private static readonly Dictionary<ulong, LinkedList<KernelQueuedEvent>> _pendingEvents = new();
+    private static long _nextEventQueueHandle = 1;
+
+    public readonly record struct KernelQueuedEvent(
+        ulong Ident,
+        short Filter,
+        ushort Flags,
+        uint Fflags,
+        ulong Data,
+        ulong UserData);
+
+    [SysAbiExport(
+        Nid = "D0OdFMjp46I",
+        ExportName = "sceKernelCreateEqueue",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelCreateEqueue(CpuContext ctx)
+    {
+        var outAddress = ctx[CpuRegister.Rdi];
+        if (outAddress == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        var handle = unchecked((ulong)Interlocked.Increment(ref _nextEventQueueHandle));
+        lock (_eventQueueGate)
+        {
+            _eventQueues.Add(handle);
+            _pendingEvents[handle] = new LinkedList<KernelQueuedEvent>();
+        }
+
+        if (!ctx.TryWriteUInt64(outAddress, handle))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        TraceEventQueue(ctx, "create", handle);
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "jpFjmgAC5AE",
+        ExportName = "sceKernelDeleteEqueue",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelDeleteEqueue(CpuContext ctx)
+    {
+        var handle = ctx[CpuRegister.Rdi];
+        lock (_eventQueueGate)
+        {
+            _eventQueues.Remove(handle);
+            _pendingEvents.Remove(handle);
+        }
+
+        TraceEventQueue(ctx, "delete", handle);
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "WDszmSbWuDk",
+        ExportName = "sceKernelAddUserEventEdge",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelAddUserEventEdge(CpuContext ctx)
+    {
+        TraceEventQueue(ctx, "add_user_edge", ctx[CpuRegister.Rdi]);
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "4R6-OvI2cEA",
+        ExportName = "sceKernelAddUserEvent",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelAddUserEvent(CpuContext ctx)
+    {
+        TraceEventQueue(ctx, "add_user", ctx[CpuRegister.Rdi]);
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "LJDwdSNTnDg",
+        ExportName = "sceKernelDeleteUserEvent",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelDeleteUserEvent(CpuContext ctx)
+    {
+        TraceEventQueue(ctx, "delete_user", ctx[CpuRegister.Rdi]);
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "F6e0kwo4cnk",
+        ExportName = "sceKernelTriggerUserEvent",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelTriggerUserEvent(CpuContext ctx)
+    {
+        TraceEventQueue(ctx, "trigger_user", ctx[CpuRegister.Rdi]);
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "bBfz7kMF2Ho",
+        ExportName = "sceKernelAddAmprEvent",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelAddAmprEvent(CpuContext ctx)
+    {
+        TraceEventQueue(ctx, "add_ampr", ctx[CpuRegister.Rdi]);
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "vuae5JPNt9A",
+        ExportName = "sceKernelAddAmprSystemEvent",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelAddAmprSystemEvent(CpuContext ctx)
+    {
+        TraceEventQueue(ctx, "add_ampr_system", ctx[CpuRegister.Rdi]);
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "bMmid3pfyjo",
+        ExportName = "sceKernelDeleteAmprEvent",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelDeleteAmprEvent(CpuContext ctx)
+    {
+        TraceEventQueue(ctx, "delete_ampr", ctx[CpuRegister.Rdi]);
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "Ij+ryuEClXQ",
+        ExportName = "sceKernelDeleteAmprSystemEvent",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelDeleteAmprSystemEvent(CpuContext ctx)
+    {
+        TraceEventQueue(ctx, "delete_ampr_system", ctx[CpuRegister.Rdi]);
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "QyrxcdBrb0M",
+        ExportName = "sceKernelGetKqueueFromEqueue",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelGetKqueueFromEqueue(CpuContext ctx)
+    {
+        ctx[CpuRegister.Rax] = ctx[CpuRegister.Rdi];
+        TraceEventQueue(ctx, "get_kqueue", ctx[CpuRegister.Rdi]);
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "fzyMKs9kim0",
+        ExportName = "sceKernelWaitEqueue",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelWaitEqueue(CpuContext ctx)
+    {
+        var handle = ctx[CpuRegister.Rdi];
+        var eventsAddress = ctx[CpuRegister.Rsi];
+        var eventCapacity = (int)Math.Min(ctx[CpuRegister.Rdx], int.MaxValue);
+        var outCountAddress = ctx[CpuRegister.Rcx];
+        var timeoutAddress = ctx[CpuRegister.R8];
+
+        var deliveredCount = DequeueEvents(ctx, handle, eventsAddress, eventCapacity);
+        if (outCountAddress != 0 && !TryWriteUInt32(ctx, outCountAddress, (uint)deliveredCount))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        if (deliveredCount > 0)
+        {
+            TraceEventQueue(ctx, "wait-deliver", handle);
+            return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+        }
+
+        if (timeoutAddress == 0 && GuestThreadExecution.RequestCurrentThreadBlock("sceKernelWaitEqueue"))
+        {
+            TraceEventQueue(ctx, "wait-block", handle);
+            return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+        }
+
+        TraceEventQueue(ctx, "wait", handle);
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    public static bool IsValidEqueue(ulong handle)
+    {
+        lock (_eventQueueGate)
+        {
+            return _eventQueues.Contains(handle);
+        }
+    }
+
+    public static bool EnqueueEvent(ulong handle, KernelQueuedEvent queuedEvent)
+    {
+        lock (_eventQueueGate)
+        {
+            if (!_eventQueues.Contains(handle))
+            {
+                return false;
+            }
+
+            if (!_pendingEvents.TryGetValue(handle, out var queue))
+            {
+                queue = new LinkedList<KernelQueuedEvent>();
+                _pendingEvents[handle] = queue;
+            }
+
+            queue.AddLast(queuedEvent);
+            return true;
+        }
+    }
+
+    public static bool TriggerDisplayEvent(
+        ulong handle,
+        ulong ident,
+        short filter,
+        ulong eventHint,
+        ulong userData)
+    {
+        lock (_eventQueueGate)
+        {
+            if (!_eventQueues.Contains(handle))
+            {
+                return false;
+            }
+
+            if (!_pendingEvents.TryGetValue(handle, out var events))
+            {
+                events = new LinkedList<KernelQueuedEvent>();
+                _pendingEvents[handle] = events;
+            }
+
+            LinkedListNode<KernelQueuedEvent>? pendingNode = null;
+            for (var node = events.First; node is not null; node = node.Next)
+            {
+                if (node.Value.Ident == ident && node.Value.Filter == filter)
+                {
+                    pendingNode = node;
+                    break;
+                }
+            }
+
+            var count = 1UL;
+            if (pendingNode is not null)
+            {
+                count = Math.Min(((pendingNode.Value.Data >> 12) & 0xFUL) + 1, 0xFUL);
+            }
+
+            var timeBits = unchecked((ulong)Environment.TickCount64) & 0xFFFUL;
+            var eventData = timeBits | (count << 12) | (eventHint & 0xFFFF_FFFF_FFFF_0000UL);
+            var triggeredEvent = new KernelQueuedEvent(
+                ident,
+                filter,
+                0x20,
+                0,
+                eventData,
+                userData);
+
+            if (pendingNode is not null)
+            {
+                pendingNode.Value = triggeredEvent;
+            }
+            else
+            {
+                events.AddLast(triggeredEvent);
+            }
+
+            return true;
+        }
+    }
+
+    private static int DequeueEvents(CpuContext ctx, ulong handle, ulong eventsAddress, int eventCapacity)
+    {
+        if (eventsAddress == 0 || eventCapacity <= 0)
+        {
+            return 0;
+        }
+
+        KernelQueuedEvent[] events;
+        lock (_eventQueueGate)
+        {
+            if (!_pendingEvents.TryGetValue(handle, out var queue) || queue.Count == 0)
+            {
+                return 0;
+            }
+
+            var count = Math.Min(eventCapacity, queue.Count);
+            events = new KernelQueuedEvent[count];
+            for (var i = 0; i < count; i++)
+            {
+                events[i] = queue.First!.Value;
+                queue.RemoveFirst();
+            }
+        }
+
+        for (var i = 0; i < events.Length; i++)
+        {
+            if (!WriteKernelEvent(ctx, eventsAddress + ((ulong)i * KernelEventSize), events[i]))
+            {
+                return i;
+            }
+        }
+
+        return events.Length;
+    }
+
+    private static bool WriteKernelEvent(CpuContext ctx, ulong address, KernelQueuedEvent queuedEvent)
+    {
+        Span<byte> eventBytes = stackalloc byte[KernelEventSize];
+        BinaryPrimitives.WriteUInt64LittleEndian(eventBytes[0x00..], queuedEvent.Ident);
+        BinaryPrimitives.WriteInt16LittleEndian(eventBytes[0x08..], queuedEvent.Filter);
+        BinaryPrimitives.WriteUInt16LittleEndian(eventBytes[0x0A..], queuedEvent.Flags);
+        BinaryPrimitives.WriteUInt32LittleEndian(eventBytes[0x0C..], queuedEvent.Fflags);
+        BinaryPrimitives.WriteUInt64LittleEndian(eventBytes[0x10..], queuedEvent.Data);
+        BinaryPrimitives.WriteUInt64LittleEndian(eventBytes[0x18..], queuedEvent.UserData);
+        return ctx.Memory.TryWrite(address, eventBytes);
+    }
+
+    private static void TraceEventQueue(CpuContext ctx, string operation, ulong handle)
+    {
+        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_EQUEUE"), "1", StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        var returnRip = 0UL;
+        _ = ctx.TryReadUInt64(ctx[CpuRegister.Rsp], out returnRip);
+        Console.Error.WriteLine(
+            $"[LOADER][TRACE] equeue.{operation}: handle=0x{handle:X16} rsi=0x{ctx[CpuRegister.Rsi]:X16} rdx=0x{ctx[CpuRegister.Rdx]:X16} ret=0x{returnRip:X16}");
+    }
+
+    private static bool TryWriteUInt32(CpuContext ctx, ulong address, uint value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(uint)];
+        BinaryPrimitives.WriteUInt32LittleEndian(buffer, value);
+        return ctx.Memory.TryWrite(address, buffer);
+    }
+}
@@ -8,10 +8,12 @@ namespace SharpEmu.Libs.Kernel;

 public static class KernelExports
 {
-    private static long _nextThreadId = 1;
    private static int _nextFileDescriptor = 2;
    private static readonly object _cxaGate = new();
    private static readonly List<CxaDestructorEntry> _cxaDestructors = new();
+    private static readonly object _coredumpGate = new();
+    private static ulong _coredumpHandler;
+    private static ulong _coredumpHandlerContext;

    private readonly record struct CxaDestructorEntry(
        ulong Function,
@@ -29,6 +31,23 @@ public static class KernelExports
        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
    }

+    [SysAbiExport(
+        Nid = "8zLSfEfW5AU",
+        ExportName = "sceCoredumpRegisterCoredumpHandler",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceCoredump")]
+    public static int CoredumpRegisterHandler(CpuContext ctx)
+    {
+        lock (_coredumpGate)
+        {
+            _coredumpHandler = ctx[CpuRegister.Rdi];
+            _coredumpHandlerContext = ctx[CpuRegister.Rsi];
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
    [SysAbiExport(
        Nid = "uMei1W9uyNo",
        ExportName = "exit",
@@ -36,7 +55,10 @@ public static class KernelExports
        LibraryName = "libKernel")]
    public static int Exit(CpuContext ctx)
    {
-        _ = ctx;
+        var status = unchecked((int)ctx[CpuRegister.Rdi]);
+        Console.Error.WriteLine($"[LOADER][INFO] exit(status={status})");
+        GuestThreadExecution.RequestCurrentEntryExit("exit", status);
+        ctx[CpuRegister.Rax] = unchecked((ulong)status);
        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
    }

@@ -49,7 +71,8 @@ public static class KernelExports
    {
        var status = unchecked((int)ctx[CpuRegister.Rdi]);
        Console.Error.WriteLine($"[LOADER][INFO] catchReturnFromMain(status={status})");
-        ctx[CpuRegister.Rax] = 0;
+        GuestThreadExecution.RequestCurrentEntryExit("catchReturnFromMain", status);
+        ctx[CpuRegister.Rax] = unchecked((ulong)status);
        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
    }

@@ -175,12 +198,37 @@ public static class KernelExports
    public static int PthreadCreate(CpuContext ctx)
    {
        var threadIdAddress = ctx[CpuRegister.Rdi];
-        var nextThreadId = unchecked((ulong)Interlocked.Increment(ref _nextThreadId));
-        if (threadIdAddress != 0 && !ctx.TryWriteUInt64(threadIdAddress, nextThreadId))
+        var attrAddress = ctx[CpuRegister.Rsi];
+        var entryAddress = ctx[CpuRegister.Rdx];
+        var argument = ctx[CpuRegister.Rcx];
+        var nameAddress = ctx[CpuRegister.R8];
+        var name = nameAddress == 0 ? string.Empty : ReadCString(ctx, nameAddress, 256);
+        var threadHandle = KernelPthreadState.CreateThreadHandle(name);
+        if (threadIdAddress != 0 && !ctx.TryWriteUInt64(threadIdAddress, threadHandle))
        {
            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
        }

+        if (ShouldTracePthread())
+        {
+            Console.Error.WriteLine(
+                $"[LOADER][TRACE] pthread_create: out=0x{threadIdAddress:X16} attr=0x{attrAddress:X16} entry=0x{entryAddress:X16} arg=0x{argument:X16} name_ptr=0x{nameAddress:X16} name='{name}' -> thread=0x{threadHandle:X16}");
+        }
+
+        var scheduler = GuestThreadExecution.Scheduler;
+        if (scheduler is not null && entryAddress != 0)
+        {
+            var request = new GuestThreadStartRequest(threadHandle, entryAddress, argument, attrAddress, name);
+            if (!scheduler.TryStartThread(ctx, request, out var error))
+            {
+                Console.Error.WriteLine(
+                    $"[LOADER][ERROR] pthread_create: failed to schedule guest thread '{name}' entry=0x{entryAddress:X16}: {error}");
+                ctx[CpuRegister.Rax] = unchecked((ulong)(int)OrbisGen2Result.ORBIS_GEN2_ERROR_TRY_AGAIN);
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_TRY_AGAIN;
+            }
+        }
+
+        ctx[CpuRegister.Rax] = 0;
        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
    }

@@ -194,6 +242,16 @@ public static class KernelExports
        return PthreadCreate(ctx);
    }

+    [SysAbiExport(
+        Nid = "Jmi+9w9u0E4",
+        ExportName = "pthread_create_name_np",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PosixPthreadCreateNameNp(CpuContext ctx)
+    {
+        return PthreadCreate(ctx);
+    }
+
    [SysAbiExport(
        Nid = "onNY9Byn-W8",
        ExportName = "scePthreadJoin",
@@ -201,12 +259,20 @@ public static class KernelExports
        LibraryName = "libKernel")]
    public static int PthreadJoin(CpuContext ctx)
    {
+        var threadId = ctx[CpuRegister.Rdi];
        var returnValueAddress = ctx[CpuRegister.Rsi];
        if (returnValueAddress != 0 && !ctx.TryWriteUInt64(returnValueAddress, 0))
        {
            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
        }

+        if (ShouldTracePthread())
+        {
+            Console.Error.WriteLine(
+                $"[LOADER][TRACE] pthread_join: thread=0x{threadId:X16} retval_out=0x{returnValueAddress:X16}");
+        }
+
+        ctx[CpuRegister.Rax] = 0;
        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
    }

@@ -225,22 +291,14 @@ public static class KernelExports
        ExportName = "open",
        Target = Generation.Gen4 | Generation.Gen5,
        LibraryName = "libKernel")]
-    public static int Open(CpuContext ctx)
-    {
-        ctx[CpuRegister.Rax] = unchecked((ulong)Interlocked.Increment(ref _nextFileDescriptor));
-        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
-    }
+    public static int Open(CpuContext ctx) => KernelMemoryCompatExports.KernelOpenUnderscore(ctx);

    [SysAbiExport(
        Nid = "1G3lF1Gg1k8",
        ExportName = "sceKernelOpen",
        Target = Generation.Gen4 | Generation.Gen5,
        LibraryName = "libKernel")]
-    public static int KernelOpen(CpuContext ctx)
-    {
-        ctx[CpuRegister.Rax] = unchecked((ulong)Interlocked.Increment(ref _nextFileDescriptor));
-        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
-    }
+    public static int KernelOpen(CpuContext ctx) => KernelMemoryCompatExports.KernelOpenUnderscore(ctx);

    [SysAbiExport(
        Nid = "hcuQgD53UxM",
@@ -251,84 +309,17 @@ public static class KernelExports
    {
        ulong fmtPtr = ctx[CpuRegister.Rdi];
        string fmt = ReadCString(ctx, fmtPtr, 4096);
-
-        ulong[] args =
+        string outStr = KernelMemoryCompatExports.FormatStringFromVarArgs(ctx, fmt, firstGpArgIndex: 1);
+        if (outStr.EndsWith('\n') || outStr.EndsWith('\r'))
        {
-        ctx[CpuRegister.Rsi],
-        ctx[CpuRegister.Rdx],
-        ctx[CpuRegister.Rcx],
-        ctx[CpuRegister.R8],
-        ctx[CpuRegister.R9],
-    };
-
-        int argIndex = 0;
-        var sb = new System.Text.StringBuilder(fmt.Length + 64);
-
-        for (int i = 0; i < fmt.Length; i++)
+            Console.Write($"[DEBUG][PRINF] {outStr}");
+        }
+        else
        {
-            char ch = fmt[i];
-            if (ch != '%')
-            {
-                sb.Append(ch);
-                continue;
-            }
-
-            if (i + 1 < fmt.Length && fmt[i + 1] == '%')
-            {
-                sb.Append('%');
-                i++;
-                continue;
-            }
-
-            int j = i + 1;
-            while (j < fmt.Length && "-+ #0".IndexOf(fmt[j]) >= 0) j++;
-            while (j < fmt.Length && char.IsDigit(fmt[j])) j++;
-
-            if (j < fmt.Length && fmt[j] == '.')
-            {
-                j++;
-                while (j < fmt.Length && char.IsDigit(fmt[j])) j++;
-            }
-
-            if (j >= fmt.Length) break;
-            char spec = fmt[j];
-            i = j;
-
-            ulong a = argIndex < args.Length ? args[argIndex++] : 0;
-
-            switch (spec)
-            {
-                case 's':
-                    sb.Append(a == 0 ? "(null)" : ReadCString(ctx, a, 4096));
-                    break;
-
-                case 'd':
-                case 'i':
-                    sb.Append(unchecked((int)a));
-                    break;
-
-                case 'u':
-                    sb.Append(unchecked((uint)a));
-                    break;
-
-                case 'x':
-                    sb.Append(unchecked((uint)a).ToString("x"));
-                    break;
-
-                case 'p':
-                    sb.Append("0x").Append(a.ToString("x16"));
-                    break;
-
-                default:
-                    sb.Append('%').Append(spec);
-                    break;
-            }
+            Console.WriteLine($"[DEBUG][PRINF] {outStr}");
        }

-        string outStr = sb.ToString();
-        Console.WriteLine($"[DEBUG][PRINF] {outStr}");
-
-        ctx[CpuRegister.Rax] = (ulong)outStr.Length;
+        ctx[CpuRegister.Rax] = (ulong)System.Text.Encoding.UTF8.GetByteCount(outStr);
        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
    }

@@ -370,4 +361,9 @@ public static class KernelExports
        try { return System.Text.Encoding.UTF8.GetString(buf.Slice(0, len)); }
        catch { return System.Text.Encoding.ASCII.GetString(buf.Slice(0, len)); }
    }
+
+    private static bool ShouldTracePthread()
+    {
+        return string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_PTHREADS"), "1", StringComparison.Ordinal);
+    }
 }
@@ -5,6 +5,7 @@ using SharpEmu.HLE;
 using System.Buffers.Binary;
 using System.Text;
 using System.Threading;
+using System.Diagnostics.CodeAnalysis;

 namespace SharpEmu.Libs.Kernel;

@@ -18,16 +19,19 @@ public static class KernelPthreadExtendedCompatExports
    private const int DefaultInheritSched = 0;
    private const int DefaultSchedPolicy = 0;
    private const int DefaultSchedPriority = 0;
+    private const ulong SyntheticRwlockHandleBase = 0x00006003_0000_0000;
+    private const ulong SyntheticPthreadAttrHandleBase = 0x00006004_0000_0000;

    private static readonly object _stateGate = new();
    private static readonly Dictionary<ulong, ThreadState> _threadStates = new();
    private static readonly Dictionary<ulong, PthreadAttrState> _attrStates = new();
-    private static readonly Dictionary<ulong, ReaderWriterLockSlim> _rwlockStates = new();
+    private static readonly Dictionary<ulong, PthreadRwlockState> _rwlockStates = new();
    private static readonly Dictionary<int, TlsKeyState> _tlsKeys = new();
    private static int _nextTlsKey = 1;
+    private static long _nextSyntheticRwlockHandleId = 1;
+    private static long _nextSyntheticPthreadAttrHandleId = 1;

-    [ThreadStatic]
-    private static Dictionary<int, ulong>? _threadLocalSpecific;
+    private static readonly Dictionary<ulong, Dictionary<int, ulong>> _threadLocalSpecific = new();

    private sealed class ThreadState
    {
@@ -38,6 +42,47 @@ public static class KernelPthreadExtendedCompatExports
        public PthreadAttrState Attributes { get; set; } = PthreadAttrState.Default;
    }

+    private sealed class PthreadRwlockState
+    {
+        public object SyncRoot { get; } = new();
+        public Dictionary<ulong, int> ReaderCounts { get; } = new();
+        public int ReaderTotalCount { get; set; }
+        public ulong WriterThreadId { get; set; }
+        public int WaitingWriters { get; set; }
+
+        public int GetReaderCount(ulong threadId)
+        {
+            return ReaderCounts.TryGetValue(threadId, out var count) ? count : 0;
+        }
+
+        public void AddReader(ulong threadId)
+        {
+            ReaderCounts.TryGetValue(threadId, out var currentCount);
+            ReaderCounts[threadId] = currentCount + 1;
+            ReaderTotalCount++;
+        }
+
+        public bool RemoveReader(ulong threadId)
+        {
+            if (!ReaderCounts.TryGetValue(threadId, out var currentCount) || currentCount <= 0)
+            {
+                return false;
+            }
+
+            if (currentCount == 1)
+            {
+                ReaderCounts.Remove(threadId);
+            }
+            else
+            {
+                ReaderCounts[threadId] = currentCount - 1;
+            }
+
+            ReaderTotalCount = Math.Max(0, ReaderTotalCount - 1);
+            return true;
+        }
+    }
+
    private readonly record struct TlsKeyState(ulong Destructor);

    private readonly record struct PthreadAttrState(
@@ -140,6 +185,35 @@ public static class KernelPthreadExtendedCompatExports
        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
    }

+    [SysAbiExport(
+        Nid = "rcrVFJsQWRY",
+        ExportName = "scePthreadGetaffinity",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PthreadGetaffinity(CpuContext ctx)
+    {
+        var thread = ctx[CpuRegister.Rdi];
+        var outMaskAddress = ctx[CpuRegister.Rsi];
+        if (thread == 0 || outMaskAddress == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        ulong affinityMask;
+        lock (_stateGate)
+        {
+            affinityMask = GetOrCreateThreadStateLocked(thread).AffinityMask;
+        }
+
+        if (!ctx.TryWriteUInt64(outMaskAddress, affinityMask))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
    [SysAbiExport(
        Nid = "1tKyG7RlMJo",
        ExportName = "scePthreadGetprio",
@@ -192,6 +266,41 @@ public static class KernelPthreadExtendedCompatExports
        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
    }

+    [SysAbiExport(
+        Nid = "Xs9hdiD7sAA",
+        ExportName = "pthread_setschedparam",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PosixPthreadSetschedparam(CpuContext ctx)
+    {
+        var thread = ctx[CpuRegister.Rdi];
+        var policy = unchecked((int)ctx[CpuRegister.Rsi]);
+        var schedParamAddress = ctx[CpuRegister.Rdx];
+        if (thread == 0 || schedParamAddress == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        if (!TryReadInt32(ctx, schedParamAddress, out var schedPriority))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        lock (_stateGate)
+        {
+            var state = GetOrCreateThreadStateLocked(thread);
+            state.Priority = schedPriority;
+            state.Attributes = state.Attributes with
+            {
+                SchedPolicy = policy,
+                SchedPriority = schedPriority,
+            };
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
    [SysAbiExport(
        Nid = "nsYoNRywwNg",
        ExportName = "scePthreadAttrInit",
@@ -205,15 +314,32 @@ public static class KernelPthreadExtendedCompatExports
            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
        }

+        var syntheticHandle = AllocateSyntheticHandle(SyntheticPthreadAttrHandleBase, ref _nextSyntheticPthreadAttrHandleId);
+        if (!ctx.TryWriteUInt64(attrAddress, syntheticHandle))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
        lock (_stateGate)
        {
            _attrStates[attrAddress] = PthreadAttrState.Default;
+            _attrStates[syntheticHandle] = PthreadAttrState.Default;
        }

        ctx[CpuRegister.Rax] = 0;
        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
    }

+    [SysAbiExport(
+        Nid = "wtkt-teR1so",
+        ExportName = "pthread_attr_init",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PosixPthreadAttrInit(CpuContext ctx)
+    {
+        return PthreadAttrInit(ctx);
+    }
+
    [SysAbiExport(
        Nid = "62KCwEMmzcM",
        ExportName = "scePthreadAttrDestroy",
@@ -227,15 +353,31 @@ public static class KernelPthreadExtendedCompatExports
            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
        }

+        var resolvedAddress = ResolvePthreadAttrHandle(ctx, attrAddress);
        lock (_stateGate)
        {
            _attrStates.Remove(attrAddress);
+            if (resolvedAddress != attrAddress)
+            {
+                _attrStates.Remove(resolvedAddress);
+            }
        }

+        _ = ctx.TryWriteUInt64(attrAddress, 0);
        ctx[CpuRegister.Rax] = 0;
        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
    }

+    [SysAbiExport(
+        Nid = "zHchY8ft5pk",
+        ExportName = "pthread_attr_destroy",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PosixPthreadAttrDestroy(CpuContext ctx)
+    {
+        return PthreadAttrDestroy(ctx);
+    }
+
    [SysAbiExport(
        Nid = "x1X76arYMxU",
        ExportName = "scePthreadAttrGet",
@@ -376,6 +518,37 @@ public static class KernelPthreadExtendedCompatExports
        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
    }

+    [SysAbiExport(
+        Nid = "-quPa4SEJUw",
+        ExportName = "scePthreadAttrGetstack",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PthreadAttrGetstack(CpuContext ctx)
+    {
+        var attrAddress = ctx[CpuRegister.Rdi];
+        var outStackAddressPointer = ctx[CpuRegister.Rsi];
+        var outStackSizeAddress = ctx[CpuRegister.Rdx];
+        if (attrAddress == 0 || outStackAddressPointer == 0 || outStackSizeAddress == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        PthreadAttrState state;
+        lock (_stateGate)
+        {
+            state = GetOrCreateAttrStateLocked(attrAddress);
+        }
+
+        if (!ctx.TryWriteUInt64(outStackAddressPointer, state.StackAddress) ||
+            !ctx.TryWriteUInt64(outStackSizeAddress, state.StackSize))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
    [SysAbiExport(
        Nid = "-fA+7ZlGDQs",
        ExportName = "scePthreadAttrGetstacksize",
@@ -568,16 +741,32 @@ public static class KernelPthreadExtendedCompatExports
            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
        }

+        var resolvedAddress = ResolvePthreadAttrHandle(ctx, attrAddress);
        lock (_stateGate)
        {
-            var state = GetOrCreateAttrStateLocked(attrAddress);
-            _attrStates[attrAddress] = state with { StackSize = stackSize };
+            var state = GetOrCreateAttrStateLocked(resolvedAddress);
+            var updated = state with { StackSize = stackSize };
+            _attrStates[resolvedAddress] = updated;
+            if (resolvedAddress != attrAddress)
+            {
+                _attrStates[attrAddress] = updated;
+            }
        }

        ctx[CpuRegister.Rax] = 0;
        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
    }

+    [SysAbiExport(
+        Nid = "2Q0z6rnBrTE",
+        ExportName = "pthread_attr_setstacksize",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PosixPthreadAttrSetstacksize(CpuContext ctx)
+    {
+        return PthreadAttrSetstacksize(ctx);
+    }
+
    [SysAbiExport(
        Nid = "6ULAa0fq4jA",
        ExportName = "scePthreadRwlockInit",
@@ -591,20 +780,31 @@ public static class KernelPthreadExtendedCompatExports
            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
        }

+        var syntheticHandle = AllocateSyntheticHandle(SyntheticRwlockHandleBase, ref _nextSyntheticRwlockHandleId);
        lock (_stateGate)
        {
-            if (_rwlockStates.Remove(rwlockAddress, out var existing))
+            var resolvedAddress = ResolveRwlockHandle(ctx, rwlockAddress);
+            if (_rwlockStates.Remove(resolvedAddress, out var existing))
            {
-                existing.Dispose();
            }

-            _rwlockStates[rwlockAddress] = new ReaderWriterLockSlim(LockRecursionPolicy.SupportsRecursion);
+            var rwlock = new PthreadRwlockState();
+            _rwlockStates[rwlockAddress] = rwlock;
+            _rwlockStates[syntheticHandle] = rwlock;
        }

+        _ = ctx.TryWriteUInt64(rwlockAddress, syntheticHandle);
        ctx[CpuRegister.Rax] = 0;
        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
    }

+    [SysAbiExport(
+        Nid = "ytQULN-nhL4",
+        ExportName = "pthread_rwlock_init",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PosixPthreadRwlockInit(CpuContext ctx) => PthreadRwlockInit(ctx);
+
    [SysAbiExport(
        Nid = "BB+kb08Tl9A",
        ExportName = "scePthreadRwlockDestroy",
@@ -618,10 +818,11 @@ public static class KernelPthreadExtendedCompatExports
            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
        }

-        ReaderWriterLockSlim? state;
+        var resolvedAddress = ResolveRwlockHandle(ctx, rwlockAddress);
+        PthreadRwlockState? state;
        lock (_stateGate)
        {
-            _rwlockStates.Remove(rwlockAddress, out state);
+            _rwlockStates.TryGetValue(resolvedAddress, out state);
        }

        if (state is null)
@@ -629,24 +830,62 @@ public static class KernelPthreadExtendedCompatExports
            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
        }

-        state.Dispose();
+        lock (state.SyncRoot)
+        {
+            if (state.WriterThreadId != 0 || state.ReaderTotalCount != 0 || state.WaitingWriters != 0)
+            {
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_BUSY;
+            }
+        }
+
+        lock (_stateGate)
+        {
+            _rwlockStates.Remove(resolvedAddress);
+            if (resolvedAddress != rwlockAddress)
+            {
+                _rwlockStates.Remove(rwlockAddress);
+            }
+        }
+
+        _ = ctx.TryWriteUInt64(rwlockAddress, 0);
        ctx[CpuRegister.Rax] = 0;
        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
    }

+    [SysAbiExport(
+        Nid = "1471ajPzxh0",
+        ExportName = "pthread_rwlock_destroy",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PosixPthreadRwlockDestroy(CpuContext ctx) => PthreadRwlockDestroy(ctx);
+
    [SysAbiExport(
        Nid = "Ox9i0c7L5w0",
        ExportName = "scePthreadRwlockRdlock",
        Target = Generation.Gen4 | Generation.Gen5,
        LibraryName = "libKernel")]
-    public static int PthreadRwlockRdlock(CpuContext ctx) => PthreadRwlockLockCore(ctx[CpuRegister.Rdi], write: false);
+    public static int PthreadRwlockRdlock(CpuContext ctx) => PthreadRwlockLockCore(ctx, ctx[CpuRegister.Rdi], write: false);
+
+    [SysAbiExport(
+        Nid = "iGjsr1WAtI0",
+        ExportName = "pthread_rwlock_rdlock",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PosixPthreadRwlockRdlock(CpuContext ctx) => PthreadRwlockRdlock(ctx);

    [SysAbiExport(
        Nid = "mqdNorrB+gI",
        ExportName = "scePthreadRwlockWrlock",
        Target = Generation.Gen4 | Generation.Gen5,
        LibraryName = "libKernel")]
-    public static int PthreadRwlockWrlock(CpuContext ctx) => PthreadRwlockLockCore(ctx[CpuRegister.Rdi], write: true);
+    public static int PthreadRwlockWrlock(CpuContext ctx) => PthreadRwlockLockCore(ctx, ctx[CpuRegister.Rdi], write: true);
+
+    [SysAbiExport(
+        Nid = "sIlRvQqsN2Y",
+        ExportName = "pthread_rwlock_wrlock",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PosixPthreadRwlockWrlock(CpuContext ctx) => PthreadRwlockWrlock(ctx);

    [SysAbiExport(
        Nid = "+L98PIbGttk",
@@ -661,40 +900,50 @@ public static class KernelPthreadExtendedCompatExports
            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
        }

-        ReaderWriterLockSlim? rwlock;
-        lock (_stateGate)
-        {
-            _rwlockStates.TryGetValue(rwlockAddress, out rwlock);
-        }
-
-        if (rwlock is null)
+        if (!TryResolveRwlockState(ctx, rwlockAddress, createIfZero: false, out _, out var rwlock))
        {
            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
        }

+        var currentThreadId = KernelPthreadState.GetCurrentThreadHandle();
+
        try
        {
-            if (rwlock.IsWriteLockHeld)
+            lock (rwlock.SyncRoot)
            {
-                rwlock.ExitWriteLock();
-            }
-            else if (rwlock.IsReadLockHeld)
-            {
-                rwlock.ExitReadLock();
-            }
-            else
-            {
-                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+                if (rwlock.WriterThreadId == currentThreadId)
+                {
+                    rwlock.WriterThreadId = 0;
+                    Monitor.PulseAll(rwlock.SyncRoot);
+                }
+                else if (rwlock.RemoveReader(currentThreadId))
+                {
+                    if (rwlock.ReaderTotalCount == 0 || rwlock.WaitingWriters > 0)
+                    {
+                        Monitor.PulseAll(rwlock.SyncRoot);
+                    }
+                }
+                else
+                {
+                    return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_PERMISSION_DENIED;
+                }
            }
        }
        catch (SynchronizationLockException)
        {
-            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_PERMISSION_DENIED;
        }

        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
    }

+    [SysAbiExport(
+        Nid = "EgmLo6EWgso",
+        ExportName = "pthread_rwlock_unlock",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PosixPthreadRwlockUnlock(CpuContext ctx) => PthreadRwlockUnlock(ctx);
+
    [SysAbiExport(
        Nid = "mqULNdimTn0",
        ExportName = "pthread_key_create",
@@ -730,6 +979,13 @@ public static class KernelPthreadExtendedCompatExports
        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
    }

+    [SysAbiExport(
+        Nid = "geDaqgH9lTg",
+        ExportName = "scePthreadKeyCreate",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int OrbisPthreadKeyCreate(CpuContext ctx) => PosixPthreadKeyCreate(ctx);
+
    [SysAbiExport(
        Nid = "6BpEZuDT7YI",
        ExportName = "pthread_key_delete",
@@ -744,13 +1000,24 @@ public static class KernelPthreadExtendedCompatExports
            {
                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
            }
+
+            foreach (var entry in _threadLocalSpecific)
+            {
+                entry.Value.Remove(key);
+            }
        }

-        _threadLocalSpecific?.Remove(key);
        ctx[CpuRegister.Rax] = 0;
        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
    }

+    [SysAbiExport(
+        Nid = "PrdHuuDekhY",
+        ExportName = "scePthreadKeyDelete",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int OrbisPthreadKeyDelete(CpuContext ctx) => PosixPthreadKeyDelete(ctx);
+
    [SysAbiExport(
        Nid = "WrOLvHU0yQM",
        ExportName = "pthread_setspecific",
@@ -760,20 +1027,34 @@ public static class KernelPthreadExtendedCompatExports
    {
        var key = unchecked((int)ctx[CpuRegister.Rdi]);
        var value = ctx[CpuRegister.Rsi];
+        var currentThreadHandle = KernelPthreadState.GetCurrentThreadHandle();
        lock (_stateGate)
        {
            if (!_tlsKeys.TryGetValue(key, out _))
            {
                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
            }
+
+            if (!_threadLocalSpecific.TryGetValue(currentThreadHandle, out var values))
+            {
+                values = new Dictionary<int, ulong>();
+                _threadLocalSpecific[currentThreadHandle] = values;
+            }
+
+            values[key] = value;
        }

-        _threadLocalSpecific ??= new Dictionary<int, ulong>();
-        _threadLocalSpecific[key] = value;
        ctx[CpuRegister.Rax] = 0;
        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
    }

+    [SysAbiExport(
+        Nid = "+BzXYkqYeLE",
+        ExportName = "scePthreadSetspecific",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int OrbisPthreadSetspecific(CpuContext ctx) => PosixPthreadSetspecific(ctx);
+
    [SysAbiExport(
        Nid = "0-KXaS70xy4",
        ExportName = "pthread_getspecific",
@@ -782,6 +1063,8 @@ public static class KernelPthreadExtendedCompatExports
    public static int PosixPthreadGetspecific(CpuContext ctx)
    {
        var key = unchecked((int)ctx[CpuRegister.Rdi]);
+        var currentThreadHandle = KernelPthreadState.GetCurrentThreadHandle();
+        ulong value = 0;
        lock (_stateGate)
        {
            if (!_tlsKeys.TryGetValue(key, out _))
@@ -789,51 +1072,176 @@ public static class KernelPthreadExtendedCompatExports
                ctx[CpuRegister.Rax] = 0;
                return (int)OrbisGen2Result.ORBIS_GEN2_OK;
            }
+
+            if (_threadLocalSpecific.TryGetValue(currentThreadHandle, out var values) &&
+                values.TryGetValue(key, out var storedValue))
+            {
+                value = storedValue;
+            }
        }

-        ctx[CpuRegister.Rax] =
-            _threadLocalSpecific is not null && _threadLocalSpecific.TryGetValue(key, out var value)
-                ? value
-                : 0UL;
+        ctx[CpuRegister.Rax] = value;
        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
    }

-    private static int PthreadRwlockLockCore(ulong rwlockAddress, bool write)
+    [SysAbiExport(
+        Nid = "eoht7mQOCmo",
+        ExportName = "scePthreadGetspecific",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int OrbisPthreadGetspecific(CpuContext ctx) => PosixPthreadGetspecific(ctx);
+
+    private static int PthreadRwlockLockCore(CpuContext ctx, ulong rwlockAddress, bool write)
    {
        if (rwlockAddress == 0)
        {
            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
        }

-        ReaderWriterLockSlim rwlock;
-        lock (_stateGate)
+        if (!TryResolveRwlockState(ctx, rwlockAddress, createIfZero: true, out _, out var rwlock))
        {
-            if (!_rwlockStates.TryGetValue(rwlockAddress, out rwlock!))
-            {
-                rwlock = new ReaderWriterLockSlim(LockRecursionPolicy.SupportsRecursion);
-                _rwlockStates[rwlockAddress] = rwlock;
-            }
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
        }

-        try
+        var currentThreadId = KernelPthreadState.GetCurrentThreadHandle();
+        lock (rwlock.SyncRoot)
        {
            if (write)
            {
-                rwlock.EnterWriteLock();
+                if (rwlock.WriterThreadId == currentThreadId || rwlock.GetReaderCount(currentThreadId) > 0)
+                {
+                    return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_DEADLOCK;
+                }
+
+                rwlock.WaitingWriters++;
+                try
+                {
+                    while (rwlock.WriterThreadId != 0 || rwlock.ReaderTotalCount != 0)
+                    {
+                        Monitor.Wait(rwlock.SyncRoot);
+                    }
+                }
+                finally
+                {
+                    rwlock.WaitingWriters--;
+                }
+
+                rwlock.WriterThreadId = currentThreadId;
            }
            else
            {
-                rwlock.EnterReadLock();
+                if (rwlock.WriterThreadId == currentThreadId)
+                {
+                    return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_DEADLOCK;
+                }
+
+                while (rwlock.WriterThreadId != 0 ||
+                       (rwlock.WaitingWriters > 0 && rwlock.GetReaderCount(currentThreadId) == 0))
+                {
+                    Monitor.Wait(rwlock.SyncRoot);
+                }
+
+                rwlock.AddReader(currentThreadId);
            }
        }
-        catch (LockRecursionException)
-        {
-            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_ALREADY_EXISTS;
-        }

        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
    }

+    private static ulong ResolveRwlockHandle(CpuContext ctx, ulong rwlockAddress)
+    {
+        if (rwlockAddress == 0)
+        {
+            return 0;
+        }
+
+        lock (_stateGate)
+        {
+            if (_rwlockStates.ContainsKey(rwlockAddress))
+            {
+                return rwlockAddress;
+            }
+        }
+
+        if (ctx.TryReadUInt64(rwlockAddress, out var pointedHandle) && pointedHandle != 0)
+        {
+            lock (_stateGate)
+            {
+                if (_rwlockStates.ContainsKey(pointedHandle))
+                {
+                    return pointedHandle;
+                }
+            }
+        }
+
+        return rwlockAddress;
+    }
+
+    private static bool TryResolveRwlockState(CpuContext ctx, ulong rwlockAddress, bool createIfZero, out ulong resolvedAddress, [NotNullWhen(true)] out PthreadRwlockState? rwlock)
+    {
+        resolvedAddress = 0;
+        rwlock = null;
+        if (rwlockAddress == 0)
+        {
+            return false;
+        }
+
+        lock (_stateGate)
+        {
+            if (_rwlockStates.TryGetValue(rwlockAddress, out rwlock))
+            {
+                resolvedAddress = rwlockAddress;
+                return true;
+            }
+        }
+
+        if (!ctx.TryReadUInt64(rwlockAddress, out var pointedHandle))
+        {
+            return false;
+        }
+
+        if (pointedHandle != 0)
+        {
+            lock (_stateGate)
+            {
+                if (_rwlockStates.TryGetValue(pointedHandle, out rwlock))
+                {
+                    _rwlockStates[rwlockAddress] = rwlock;
+                    resolvedAddress = pointedHandle;
+                    return true;
+                }
+            }
+
+            resolvedAddress = pointedHandle;
+            return false;
+        }
+
+        if (!createIfZero)
+        {
+            resolvedAddress = rwlockAddress;
+            return false;
+        }
+
+        var createdRwlock = new PthreadRwlockState();
+        var syntheticHandle = AllocateSyntheticHandle(SyntheticRwlockHandleBase, ref _nextSyntheticRwlockHandleId);
+        lock (_stateGate)
+        {
+            _rwlockStates[rwlockAddress] = createdRwlock;
+            _rwlockStates[syntheticHandle] = createdRwlock;
+        }
+
+        _ = ctx.TryWriteUInt64(rwlockAddress, syntheticHandle);
+        resolvedAddress = syntheticHandle;
+        rwlock = createdRwlock;
+        return true;
+    }
+
+    private static ulong AllocateSyntheticHandle(ulong baseAddress, ref long nextId)
+    {
+        var id = unchecked((ulong)Interlocked.Increment(ref nextId));
+        return baseAddress + (id << 4);
+    }
+
    private static ThreadState GetOrCreateThreadStateLocked(ulong thread)
    {
        if (_threadStates.TryGetValue(thread, out var state))
@@ -841,9 +1249,13 @@ public static class KernelPthreadExtendedCompatExports
            return state;
        }

+        var name = KernelPthreadState.TryGetThreadIdentity(thread, out var identity)
+            ? identity.Name
+            : $"Thread-{thread:X}";
+
        state = new ThreadState
        {
-            Name = $"Thread-{thread:X}",
+            Name = name,
            Priority = DefaultThreadPriority,
            AffinityMask = DefaultThreadAffinityMask,
            DetachState = DefaultDetachState,
@@ -865,6 +1277,35 @@ public static class KernelPthreadExtendedCompatExports
        return state;
    }

+    private static ulong ResolvePthreadAttrHandle(CpuContext ctx, ulong attrAddress)
+    {
+        if (attrAddress == 0)
+        {
+            return 0;
+        }
+
+        lock (_stateGate)
+        {
+            if (_attrStates.ContainsKey(attrAddress))
+            {
+                return attrAddress;
+            }
+        }
+
+        if (ctx.TryReadUInt64(attrAddress, out var pointedHandle) && pointedHandle != 0)
+        {
+            lock (_stateGate)
+            {
+                if (_attrStates.ContainsKey(pointedHandle))
+                {
+                    return pointedHandle;
+                }
+            }
+        }
+
+        return attrAddress;
+    }
+
    private static bool TryWriteFixedUtf8CString(CpuContext ctx, ulong address, string value, int maxBytes)
    {
        if (maxBytes <= 0)
@@ -0,0 +1,91 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Runtime.InteropServices;
+using System.Threading;
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.Kernel;
+
+internal static class KernelPthreadState
+{
+    private const int ThreadObjectSize = 0x1000;
+
+    private static readonly object Gate = new();
+    private static readonly Dictionary<ulong, ThreadIdentity> Threads = new();
+    private static readonly byte[] ZeroThreadObject = new byte[ThreadObjectSize];
+    private static long _nextUniqueThreadId = 1;
+
+    [ThreadStatic]
+    private static ulong _currentThreadHandle;
+
+    [ThreadStatic]
+    private static ulong _currentThreadUniqueId;
+
+    internal readonly record struct ThreadIdentity(ulong UniqueId, string Name);
+
+    internal static ulong GetCurrentThreadHandle()
+    {
+        var guestThreadHandle = GuestThreadExecution.CurrentGuestThreadHandle;
+        if (guestThreadHandle != 0 && TryGetThreadIdentity(guestThreadHandle, out _))
+        {
+            return guestThreadHandle;
+        }
+
+        EnsureCurrentThreadRegistered();
+        return _currentThreadHandle;
+    }
+
+    internal static ulong GetCurrentThreadUniqueId()
+    {
+        var guestThreadHandle = GuestThreadExecution.CurrentGuestThreadHandle;
+        if (guestThreadHandle != 0 && TryGetThreadIdentity(guestThreadHandle, out var identity))
+        {
+            return identity.UniqueId;
+        }
+
+        EnsureCurrentThreadRegistered();
+        return _currentThreadUniqueId;
+    }
+
+    internal static ulong CreateThreadHandle(string name)
+    {
+        var uniqueId = unchecked((ulong)Interlocked.Increment(ref _nextUniqueThreadId));
+        return AllocateThreadHandle(uniqueId, name);
+    }
+
+    internal static bool TryGetThreadIdentity(ulong threadHandle, out ThreadIdentity identity)
+    {
+        lock (Gate)
+        {
+            return Threads.TryGetValue(threadHandle, out identity);
+        }
+    }
+
+    private static void EnsureCurrentThreadRegistered()
+    {
+        if (_currentThreadHandle != 0)
+        {
+            return;
+        }
+
+        var uniqueId = unchecked((ulong)Interlocked.Increment(ref _nextUniqueThreadId));
+        var name = $"Thread-{uniqueId:X}";
+        _currentThreadHandle = AllocateThreadHandle(uniqueId, name);
+        _currentThreadUniqueId = uniqueId;
+    }
+
+    private static ulong AllocateThreadHandle(ulong uniqueId, string name)
+    {
+        var pointer = Marshal.AllocHGlobal(ThreadObjectSize);
+        Marshal.Copy(ZeroThreadObject, 0, pointer, ThreadObjectSize);
+
+        var handle = unchecked((ulong)pointer.ToInt64());
+        lock (Gate)
+        {
+            Threads[handle] = new ThreadIdentity(uniqueId, string.IsNullOrWhiteSpace(name) ? $"Thread-{uniqueId:X}" : name);
+        }
+
+        return handle;
+    }
+}
@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later

 using SharpEmu.HLE;
+using SharpEmu.Libs.Fiber;
 using System.Buffers.Binary;
 using System.Collections.Generic;
 using System.Diagnostics;
@@ -25,12 +26,16 @@ public static class KernelRuntimeCompatExports
    private const ulong TlsNewReplaceOffset = 0x300;
    private const int MallocReplaceSize = 0x70;
    private const int NewReplaceSize = 0x68;
+    private const int OrbisTimesecSize = sizeof(long) + sizeof(uint) + sizeof(uint);
    private const ulong ModuleInfoHandleOffset = 0x108;
    private const ulong ModuleInfoNameOffset = 0x10;
    private const int ModuleInfoNameMaxBytes = 64;
    private const ulong DefaultKernelTscFrequency = 10_000_000UL;
    private const ulong PrtAreaStartAddress = 0x0000001000000000UL;
    private const ulong PrtAreaSize = 0x000000EC00000000UL;
+    private const int MapFlagFixed = 0x10;
+    private const ulong DefaultVirtualRangeAlignment = 0x4000UL;
+    private const int AioInitParamSize = 0x3C;
    private const uint MemCommit = 0x1000;
    private const uint MemReserve = 0x2000;
    private const uint PageExecuteReadWrite = 0x40;
@@ -39,7 +44,10 @@ public static class KernelRuntimeCompatExports
    private static readonly RdtscDelegate? _rdtscReader = CreateRdtscReader();
    private static readonly ulong _kernelTscFrequency = ResolveKernelTscFrequency();
    private static readonly ulong _stackChkGuardValue = 0xC0DEC0DECAFEBABEUL;
-    private static readonly nint _stackChkGuardObjectAddress = AllocateStackChkGuardObject();
+    private static readonly nint _stackChkGuardObjectAddress =
+        HleDataSymbols.TryGetAddress("f7uOxY9mM1U", out var stackChkGuardAddress)
+            ? unchecked((nint)stackChkGuardAddress)
+            : AllocateStackChkGuardObject();
    private static ulong _applicationHeapApiAddress;
    private static ulong _processProcParamAddress;
    private static ulong _nextReservedVirtualBase = 0x6000_0000_0UL;
@@ -48,6 +56,7 @@ public static class KernelRuntimeCompatExports
    private static readonly object _prtApertureGate = new();
    private static readonly (ulong Base, ulong Size)[] _prtApertures = new (ulong Base, ulong Size)[3];
    private static int _stackChkFailCount;
+    private static long _usleepTraceCount;

    [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
    private delegate ulong RdtscDelegate();
@@ -60,33 +69,81 @@ public static class KernelRuntimeCompatExports
    public static int KernelUsleep(CpuContext ctx)
    {
        var micros = ctx[CpuRegister.Rdi];
+        TraceUsleepSpin(ctx, micros);
        if (micros == 0)
        {
            ctx[CpuRegister.Rax] = 0;
            return (int)OrbisGen2Result.ORBIS_GEN2_OK;
        }

-        var sleepMilliseconds = (int)Math.Min(micros / 1000UL, int.MaxValue);
-        if (sleepMilliseconds > 0)
-        {
-            Thread.Sleep(sleepMilliseconds);
-        }
+        GuestThreadExecution.Scheduler?.Pump(ctx, "sceKernelUsleep");

-        var remainingMicros = micros % 1000UL;
-        if (remainingMicros > 0)
+        if (micros < 1000)
        {
-            var targetTicks = (long)((double)remainingMicros * Stopwatch.Frequency / 1_000_000.0);
-            var spin = Stopwatch.StartNew();
-            while (spin.ElapsedTicks < targetTicks)
-            {
-                Thread.SpinWait(16);
-            }
+            Thread.Yield();
+        }
+        else
+        {
+            var sleepMilliseconds = (int)Math.Min((micros + 999UL) / 1000UL, int.MaxValue);
+            Thread.Sleep(sleepMilliseconds);
        }

        ctx[CpuRegister.Rax] = 0;
        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
    }

+    private static void TraceUsleepSpin(CpuContext ctx, ulong micros)
+    {
+        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_USLEEP"), "1", StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        var count = Interlocked.Increment(ref _usleepTraceCount);
+        if (count > 32 && count % 10000 != 0)
+        {
+            return;
+        }
+
+        var rbx = ctx[CpuRegister.Rbx];
+        var r12 = ctx[CpuRegister.R12];
+        var r13 = ctx[CpuRegister.R13];
+        var lockAddress = rbx == 0 ? 0 : rbx + 0xF78;
+        var lockText = "unreadable";
+        if (lockAddress != 0 && ctx.TryReadUInt64(lockAddress, out var lockValue))
+        {
+            lockText = $"0x{lockValue:X16}";
+        }
+
+        var schedulerText = "unreadable";
+        if (r12 != 0 && ctx.TryReadUInt64(r12 + 8, out var schedulerAddress))
+        {
+            schedulerText = $"0x{schedulerAddress:X16}";
+        }
+
+        var waitValueText = "unreadable";
+        if (r13 != 0 && ctx.TryReadUInt64(r13, out var waitValue))
+        {
+            waitValueText = $"0x{waitValue:X16}";
+        }
+
+        var callerReturnText = "unreadable";
+        var rbp = ctx[CpuRegister.Rbp];
+        if (rbp != 0 && ctx.TryReadUInt64(rbp + 8, out var callerReturn))
+        {
+            callerReturnText = $"0x{callerReturn:X16}";
+        }
+
+        var returnRip = GuestThreadExecution.TryGetCurrentImportCallFrame(out var frame)
+            ? frame.ReturnRip
+            : 0UL;
+        var thread = GuestThreadExecution.CurrentGuestThreadHandle;
+        var fiber = FiberExports.GetCurrentFiberAddressForDiagnostics(ctx);
+
+        Console.Error.WriteLine(
+            $"[LOADER][TRACE] usleep#{count}: usec={micros} ret=0x{returnRip:X16} caller={callerReturnText} thread=0x{thread:X16} fiber=0x{fiber:X16} rbx=0x{rbx:X16} lock@+F78=0x{lockAddress:X16}:{lockText} r12=0x{r12:X16} scheduler@+8={schedulerText} r13=0x{r13:X16}:{waitValueText} r14=0x{ctx[CpuRegister.R14]:X16} r15=0x{ctx[CpuRegister.R15]:X16}");
+    }
+
    [SysAbiExport(
        Nid = "QBi7HCK03hw",
        ExportName = "sceKernelClockGettime",
@@ -152,6 +209,37 @@ public static class KernelRuntimeCompatExports
        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
    }

+    [SysAbiExport(
+        Nid = "n88vx3C5nW8",
+        ExportName = "gettimeofday",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PosixGettimeofday(CpuContext ctx)
+    {
+        var timeAddress = ctx[CpuRegister.Rdi];
+        var timezoneAddress = ctx[CpuRegister.Rsi];
+        var now = DateTimeOffset.UtcNow;
+        var seconds = now.ToUnixTimeSeconds();
+        var microseconds = (now.Ticks % TimeSpan.TicksPerSecond) / 10;
+
+        if (timeAddress != 0 &&
+            (!ctx.TryWriteUInt64(timeAddress, unchecked((ulong)seconds)) ||
+             !ctx.TryWriteUInt64(timeAddress + sizeof(long), unchecked((ulong)microseconds))))
+        {
+            return -1;
+        }
+
+        if (timezoneAddress != 0 &&
+            (!TryWriteInt32(ctx, timezoneAddress, 0) ||
+             !TryWriteInt32(ctx, timezoneAddress + sizeof(int), 0)))
+        {
+            return -1;
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return 0;
+    }
+
    [SysAbiExport(
        Nid = "-2IRUCO--PM",
        ExportName = "sceKernelReadTsc",
@@ -254,6 +342,8 @@ public static class KernelRuntimeCompatExports
            }
        }

+        TraceProcParam(ctx, address);
+
        ctx[CpuRegister.Rax] = address;
        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
    }
@@ -266,6 +356,223 @@ public static class KernelRuntimeCompatExports
        }
    }

+    private static void TraceProcParam(CpuContext ctx, ulong address)
+    {
+        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_PROC_PARAM"), "1", StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        if (address == 0)
+        {
+            Console.Error.WriteLine("[LOADER][TRACE] proc_param: address=0");
+            return;
+        }
+
+        const int dumpSize = 0x200;
+        var buffer = GC.AllocateUninitializedArray<byte>(dumpSize);
+        if (!ctx.Memory.TryRead(address, buffer))
+        {
+            Console.Error.WriteLine($"[LOADER][TRACE] proc_param: address=0x{address:X16} unreadable");
+            return;
+        }
+
+        Console.Error.WriteLine($"[LOADER][TRACE] proc_param: address=0x{address:X16} size=0x{dumpSize:X}");
+        for (var offset = 0; offset < dumpSize; offset += 16)
+        {
+            var slice = buffer.AsSpan(offset, 16);
+            var hex = Convert.ToHexString(slice);
+            Console.Error.WriteLine($"[LOADER][TRACE] proc_param[{offset:X3}]: {hex}");
+        }
+
+        TraceProcParamPointers(ctx, address, buffer);
+    }
+
+    private static void TraceProcParamPointers(CpuContext ctx, ulong baseAddress, ReadOnlySpan<byte> buffer)
+    {
+        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_PROC_PARAM_PTRS"), "1", StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        if (buffer.Length < 0x50)
+        {
+            return;
+        }
+
+        for (var offset = 0x20; offset <= 0x48; offset += 8)
+        {
+            var ptr = BinaryPrimitives.ReadUInt64LittleEndian(buffer.Slice(offset, 8));
+            Console.Error.WriteLine($"[LOADER][TRACE] proc_param.ptr@{offset:X2}: 0x{ptr:X16}");
+            if (ptr == 0)
+            {
+                continue;
+            }
+
+            TraceProcParamPointerTarget(ctx, ptr);
+        }
+    }
+
+    private static void TraceProcParamPointerTarget(CpuContext ctx, ulong address)
+    {
+        const int maxAsciiBytes = 256;
+        const int maxWideChars = 128;
+
+        if (TryReadUtf8CString(ctx, address, maxAsciiBytes, out var asciiValue))
+        {
+            Console.Error.WriteLine($"[LOADER][TRACE] proc_param.ptr.target ascii@0x{address:X16}: \"{asciiValue}\"");
+            return;
+        }
+
+        if (TryReadUtf16CString(ctx, address, maxWideChars, out var wideValue))
+        {
+            Console.Error.WriteLine($"[LOADER][TRACE] proc_param.ptr.target wide@0x{address:X16}: \"{wideValue}\"");
+            return;
+        }
+
+        var preview = GC.AllocateUninitializedArray<byte>(64);
+        if (ctx.Memory.TryRead(address, preview))
+        {
+            var hex = Convert.ToHexString(preview);
+            Console.Error.WriteLine($"[LOADER][TRACE] proc_param.ptr.target hex@0x{address:X16}: {hex}");
+            TraceProcParamEmbeddedPointers(ctx, address, preview);
+        }
+        else
+        {
+            Console.Error.WriteLine($"[LOADER][TRACE] proc_param.ptr.target unreadable@0x{address:X16}");
+        }
+    }
+
+    private static bool TryReadUtf8CString(CpuContext ctx, ulong address, int maxBytes, out string value)
+    {
+        value = string.Empty;
+        var buffer = GC.AllocateUninitializedArray<byte>(maxBytes);
+        if (!ctx.Memory.TryRead(address, buffer))
+        {
+            return false;
+        }
+
+        var length = Array.IndexOf(buffer, (byte)0);
+        if (length < 0)
+        {
+            length = maxBytes;
+        }
+
+        if (length == 0)
+        {
+            return false;
+        }
+
+        var text = Encoding.UTF8.GetString(buffer, 0, length);
+        if (!IsMostlyPrintable(text))
+        {
+            return false;
+        }
+
+        value = text;
+        return true;
+    }
+
+    private static bool TryReadUtf16CString(CpuContext ctx, ulong address, int maxChars, out string value)
+    {
+        value = string.Empty;
+        var maxBytes = maxChars * 2;
+        var buffer = GC.AllocateUninitializedArray<byte>(maxBytes);
+        if (!ctx.Memory.TryRead(address, buffer))
+        {
+            return false;
+        }
+
+        var lengthBytes = -1;
+        for (var i = 0; i + 1 < buffer.Length; i += 2)
+        {
+            if (buffer[i] == 0 && buffer[i + 1] == 0)
+            {
+                lengthBytes = i;
+                break;
+            }
+        }
+
+        if (lengthBytes <= 0)
+        {
+            return false;
+        }
+
+        var text = Encoding.Unicode.GetString(buffer, 0, lengthBytes);
+        if (!IsMostlyPrintable(text))
+        {
+            return false;
+        }
+
+        value = text;
+        return true;
+    }
+
+    private static bool IsMostlyPrintable(string text)
+    {
+        if (string.IsNullOrWhiteSpace(text))
+        {
+            return false;
+        }
+
+        var printable = 0;
+        for (var i = 0; i < text.Length; i++)
+        {
+            var ch = text[i];
+            if (ch == '\0')
+            {
+                continue;
+            }
+
+            if (!char.IsControl(ch) || ch == '\r' || ch == '\n' || ch == '\t')
+            {
+                printable++;
+            }
+        }
+
+        return printable >= Math.Max(4, text.Length * 3 / 4);
+    }
+
+    private static void TraceProcParamEmbeddedPointers(CpuContext ctx, ulong baseAddress, ReadOnlySpan<byte> data)
+    {
+        const int maxCandidates = 12;
+        var found = 0;
+        Span<byte> probe = stackalloc byte[2];
+
+        for (var offset = 0; offset + 8 <= data.Length; offset += 8)
+        {
+            var candidate = BinaryPrimitives.ReadUInt64LittleEndian(data.Slice(offset, 8));
+            if (candidate == 0)
+            {
+                continue;
+            }
+
+            if (!ctx.Memory.TryRead(candidate, probe))
+            {
+                continue;
+            }
+
+            if (TryReadUtf8CString(ctx, candidate, 256, out var ascii))
+            {
+                Console.Error.WriteLine($"[LOADER][TRACE] proc_param.ptr.embed@0x{baseAddress:X16}+0x{offset:X2} -> 0x{candidate:X16} ascii \"{ascii}\"");
+                if (++found >= maxCandidates)
+                {
+                    return;
+                }
+                continue;
+            }
+
+            if (TryReadUtf16CString(ctx, candidate, 128, out var wide))
+            {
+                Console.Error.WriteLine($"[LOADER][TRACE] proc_param.ptr.embed@0x{baseAddress:X16}+0x{offset:X2} -> 0x{candidate:X16} wide \"{wide}\"");
+                if (++found >= maxCandidates)
+                {
+                    return;
+                }
+            }
+        }
+    }
+
    [SysAbiExport(
        Nid = "9BcDykPmo1I",
        ExportName = "__error",
@@ -329,6 +636,17 @@ public static class KernelRuntimeCompatExports
        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
    }

+    [SysAbiExport(
+        Nid = "jh+8XiK4LeE",
+        ExportName = "sceKernelIsAddressSanitizerEnabled",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelIsAddressSanitizerEnabled(CpuContext ctx)
+    {
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
    [SysAbiExport(
        Nid = "ca7v6Cxulzs",
        ExportName = "sceKernelSetGPO",
@@ -367,7 +685,7 @@ public static class KernelRuntimeCompatExports
    {
        var inOutAddressPointer = ctx[CpuRegister.Rdi];
        var length = ctx[CpuRegister.Rsi];
-        var _flags = ctx[CpuRegister.Rdx];
+        var flags = unchecked((int)ctx[CpuRegister.Rdx]);
        var alignment = ctx[CpuRegister.Rcx];
        if (inOutAddressPointer == 0 || length == 0)
        {
@@ -379,7 +697,8 @@ public static class KernelRuntimeCompatExports
            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
        }

-        var effectiveAlignment = alignment == 0 ? 0x10000UL : alignment;
+        var effectiveAlignment = alignment == 0 ? DefaultVirtualRangeAlignment : alignment;
+        var fixedMapping = (flags & MapFlagFixed) != 0;
        ulong desiredAddress;
        lock (_stateGate)
        {
@@ -388,13 +707,13 @@ public static class KernelRuntimeCompatExports
                : AlignUp(_nextReservedVirtualBase, effectiveAlignment);
        }

-        if (!TryReserveVirtualRange(ctx, desiredAddress, length, out var mappedAddress))
+        if (!TryReserveVirtualRange(ctx, desiredAddress, length, effectiveAlignment, allowSearch: !fixedMapping, out var mappedAddress))
        {
            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
        }

        Console.Error.WriteLine(
-            $"[LOADER][TRACE] reserve_virtual_range: req=0x{requestedAddress:X16} desired=0x{desiredAddress:X16} mapped=0x{mappedAddress:X16} len=0x{length:X16}");
+            $"[LOADER][TRACE] reserve_virtual_range: req=0x{requestedAddress:X16} desired=0x{desiredAddress:X16} mapped=0x{mappedAddress:X16} len=0x{length:X16} flags=0x{flags:X8} align=0x{effectiveAlignment:X16}");

        if (!ctx.TryWriteUInt64(inOutAddressPointer, mappedAddress))
        {
@@ -678,14 +997,12 @@ public static class KernelRuntimeCompatExports
    public static int StackCheckFail(CpuContext ctx)
    {
        var count = Interlocked.Increment(ref _stackChkFailCount);
-        if (count <= 8)
-        {
-            Console.Error.WriteLine(
-                $"[LOADER][WARNING] __stack_chk_fail recovery#{count}: rip=0x{ctx.Rip:X16} rdi=0x{ctx[CpuRegister.Rdi]:X16}");
-        }
-
-        ctx[CpuRegister.Rax] = 0;
-        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+        Console.Error.WriteLine(
+            $"[LOADER][ERROR] __stack_chk_fail#{count}: rip=0x{ctx.Rip:X16} rdi=0x{ctx[CpuRegister.Rdi]:X16}");
+        var result = (int)OrbisGen2Result.ORBIS_GEN2_ERROR_CPU_TRAP;
+        GuestThreadExecution.RequestCurrentEntryExit("__stack_chk_fail", result);
+        ctx[CpuRegister.Rax] = unchecked((ulong)result);
+        return result;
    }

    [SysAbiExport(
@@ -777,6 +1094,153 @@ public static class KernelRuntimeCompatExports
        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
    }

+    [SysAbiExport(
+        Nid = "nu4a0-arQis",
+        ExportName = "sceKernelAioInitializeParam",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelAioInitializeParam(CpuContext ctx)
+    {
+        var paramAddress = ctx[CpuRegister.Rdi];
+        if (paramAddress == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        Span<byte> zero = stackalloc byte[AioInitParamSize];
+        zero.Clear();
+        if (!ctx.Memory.TryWrite(paramAddress, zero))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "-o5uEDpN+oY",
+        ExportName = "sceKernelConvertUtcToLocaltime",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelConvertUtcToLocaltime(CpuContext ctx)
+    {
+        var utcSeconds = unchecked((long)ctx[CpuRegister.Rdi]);
+        var localTimeAddress = ctx[CpuRegister.Rsi];
+        var timesecAddress = ctx[CpuRegister.Rdx];
+        var dstSecondsAddress = ctx[CpuRegister.Rcx];
+
+        if (localTimeAddress == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        var utc = DateTimeOffset.FromUnixTimeSeconds(utcSeconds);
+        var local = TimeZoneInfo.ConvertTime(utc, TimeZoneInfo.Local);
+        var offset = local.Offset;
+        var localSeconds = utcSeconds + (long)offset.TotalSeconds;
+        var dstSeconds = TimeZoneInfo.Local.IsDaylightSavingTime(local.DateTime)
+            ? (uint)Math.Max(0, TimeZoneInfo.Local.GetAdjustmentRules()
+                .Where(rule => rule.DateStart <= local.Date && rule.DateEnd >= local.Date)
+                .Select(rule => rule.DaylightDelta.TotalSeconds)
+                .DefaultIfEmpty(0)
+                .Max())
+            : 0u;
+        var westSeconds = unchecked((uint)(int)offset.TotalSeconds);
+
+        if (!ctx.TryWriteUInt64(localTimeAddress, unchecked((ulong)localSeconds)))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        if (timesecAddress != 0)
+        {
+            Span<byte> timesec = stackalloc byte[OrbisTimesecSize];
+            BinaryPrimitives.WriteInt64LittleEndian(timesec, utcSeconds);
+            BinaryPrimitives.WriteUInt32LittleEndian(timesec.Slice(sizeof(long), sizeof(uint)), westSeconds);
+            BinaryPrimitives.WriteUInt32LittleEndian(timesec.Slice(sizeof(long) + sizeof(uint), sizeof(uint)), dstSeconds);
+            if (!ctx.Memory.TryWrite(timesecAddress, timesec))
+            {
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+            }
+        }
+
+        if (dstSecondsAddress != 0 && !ctx.TryWriteUInt64(dstSecondsAddress, dstSeconds))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "0NTHN1NKONI",
+        ExportName = "sceKernelConvertLocaltimeToUtc",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelConvertLocaltimeToUtc(CpuContext ctx)
+    {
+        var localSeconds = unchecked((long)ctx[CpuRegister.Rdi]);
+        var utcTimeAddress = ctx[CpuRegister.Rdx];
+        var timezoneAddress = ctx[CpuRegister.Rcx];
+        var dstSecondsAddress = ctx[CpuRegister.R8];
+
+        if (timezoneAddress == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        var localDate = DateTimeOffset.FromUnixTimeSeconds(localSeconds).DateTime;
+        var offset = TimeZoneInfo.Local.GetUtcOffset(localDate);
+        var utcSeconds = localSeconds - (long)offset.TotalSeconds;
+        var dstSeconds = TimeZoneInfo.Local.IsDaylightSavingTime(localDate)
+            ? (int)Math.Max(0, TimeZoneInfo.Local.GetAdjustmentRules()
+                .Where(rule => rule.DateStart <= localDate.Date && rule.DateEnd >= localDate.Date)
+                .Select(rule => rule.DaylightDelta.TotalSeconds)
+                .DefaultIfEmpty(0)
+                .Max())
+            : 0;
+        var minutesWest = unchecked((int)-offset.TotalMinutes);
+
+        if (!TryWriteInt32(ctx, timezoneAddress, minutesWest) ||
+            !TryWriteInt32(ctx, timezoneAddress + sizeof(int), dstSeconds / 60))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        if (utcTimeAddress != 0 && !ctx.TryWriteUInt64(utcTimeAddress, unchecked((ulong)utcSeconds)))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        if (dstSecondsAddress != 0 && !TryWriteInt32(ctx, dstSecondsAddress, dstSeconds))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "vYU8P9Td2Zo",
+        ExportName = "sceKernelAioInitializeImpl",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelAioInitializeImpl(CpuContext ctx)
+    {
+        var paramAddress = ctx[CpuRegister.Rdi];
+        var size = unchecked((int)ctx[CpuRegister.Rsi]);
+        if (paramAddress == 0 || size < AioInitParamSize)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
    [SysAbiExport(
        Nid = "eR2bZFAAU0Q",
        ExportName = "sceSysmoduleUnloadModule",
@@ -1223,7 +1687,13 @@ public static class KernelRuntimeCompatExports
    [DllImport("kernel32.dll", SetLastError = true)]
    private static extern nint VirtualAlloc(nint lpAddress, nuint dwSize, uint flAllocationType, uint flProtect);

-    private static bool TryReserveVirtualRange(CpuContext ctx, ulong desiredAddress, ulong length, out ulong mappedAddress)
+    private static bool TryReserveVirtualRange(
+        CpuContext ctx,
+        ulong desiredAddress,
+        ulong length,
+        ulong alignment,
+        bool allowSearch,
+        out ulong mappedAddress)
    {
        mappedAddress = 0;
        if (length == 0)
@@ -1235,40 +1705,51 @@ public static class KernelRuntimeCompatExports
        {
            object memoryObject = ctx.Memory;
            MethodInfo? allocateAt = null;
+            MethodInfo? allocateAtOrAbove = null;
            var allocateAtHasAllowAlternativeArg = false;
            for (var depth = 0; depth < 4; depth++)
            {
                foreach (var candidate in memoryObject.GetType().GetMethods(BindingFlags.Public | BindingFlags.Instance))
                {
-                    if (!string.Equals(candidate.Name, "AllocateAt", StringComparison.Ordinal))
-                    {
-                        continue;
-                    }
-
                    var parameters = candidate.GetParameters();
-                    if (parameters.Length == 3 &&
-                        parameters[0].ParameterType == typeof(ulong) &&
-                        parameters[1].ParameterType == typeof(ulong) &&
-                        parameters[2].ParameterType == typeof(bool))
-                    {
-                        allocateAt = candidate;
-                        allocateAtHasAllowAlternativeArg = false;
-                        break;
-                    }
-
-                    if (parameters.Length == 4 &&
+                    if (string.Equals(candidate.Name, "TryAllocateAtOrAbove", StringComparison.Ordinal) &&
+                        parameters.Length == 5 &&
                        parameters[0].ParameterType == typeof(ulong) &&
                        parameters[1].ParameterType == typeof(ulong) &&
                        parameters[2].ParameterType == typeof(bool) &&
-                        parameters[3].ParameterType == typeof(bool))
+                        parameters[3].ParameterType == typeof(ulong) &&
+                        parameters[4].ParameterType == typeof(ulong).MakeByRefType())
+                    {
+                        allocateAtOrAbove = candidate;
+                    }
+                    else if (string.Equals(candidate.Name, "AllocateAt", StringComparison.Ordinal))
+                    {
+                        if (parameters.Length == 3 &&
+                            parameters[0].ParameterType == typeof(ulong) &&
+                            parameters[1].ParameterType == typeof(ulong) &&
+                            parameters[2].ParameterType == typeof(bool))
+                        {
+                            allocateAt = candidate;
+                            allocateAtHasAllowAlternativeArg = false;
+                        }
+                        else if (parameters.Length == 4 &&
+                            parameters[0].ParameterType == typeof(ulong) &&
+                            parameters[1].ParameterType == typeof(ulong) &&
+                            parameters[2].ParameterType == typeof(bool) &&
+                            parameters[3].ParameterType == typeof(bool))
+                        {
+                            allocateAt = candidate;
+                            allocateAtHasAllowAlternativeArg = true;
+                        }
+                    }
+
+                    if (allocateAtOrAbove is not null && allocateAt is not null)
                    {
-                        allocateAt = candidate;
-                        allocateAtHasAllowAlternativeArg = true;
                        break;
                    }
                }

-                if (allocateAt is not null)
+                if (allocateAtOrAbove is not null || allocateAt is not null)
                {
                    break;
                }
@@ -1288,6 +1769,18 @@ public static class KernelRuntimeCompatExports
                memoryObject = innerValue;
            }

+            if (allowSearch && allocateAtOrAbove is not null)
+            {
+                var searchArgs = new object[] { desiredAddress, length, false, alignment, 0UL };
+                var searchResult = allocateAtOrAbove.Invoke(memoryObject, searchArgs);
+                if (searchResult is bool trueValue && trueValue &&
+                    searchArgs[4] is ulong searchedAddress && searchedAddress != 0)
+                {
+                    mappedAddress = searchedAddress;
+                    return true;
+                }
+            }
+
            if (allocateAt is null)
            {
                Console.Error.WriteLine($"[LOADER][TRACE] reserve_virtual_range: AllocateAt missing on {ctx.Memory.GetType().FullName}");
@@ -1295,7 +1788,7 @@ public static class KernelRuntimeCompatExports
            }

            var invokeArgs = allocateAtHasAllowAlternativeArg
-                ? new object[] { desiredAddress, length, false, true }
+                ? new object[] { desiredAddress, length, false, false }
                : new object[] { desiredAddress, length, false };
            var result = allocateAt.Invoke(memoryObject, invokeArgs);
            if (result is not ulong allocated || allocated == 0)
@@ -0,0 +1,318 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Buffers.Binary;
+using System.Collections.Concurrent;
+using System.Text;
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.Kernel;
+
+public static class KernelSemaphoreCompatExports
+{
+    private const int MaxSemaphoreNameLength = 128;
+    private static readonly ConcurrentDictionary<uint, KernelSemaphoreState> _semaphores = new();
+    private static int _nextSemaphoreHandle = 1;
+
+    private sealed class KernelSemaphoreState
+    {
+        public required string Name { get; init; }
+        public required int InitialCount { get; init; }
+        public required int MaxCount { get; init; }
+        public int Count { get; set; }
+        public int WaitingThreads { get; set; }
+        public object Gate { get; } = new();
+    }
+
+    [SysAbiExport(
+        Nid = "188x57JYp0g",
+        ExportName = "sceKernelCreateSema",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelCreateSema(CpuContext ctx)
+    {
+        var semaphoreAddress = ctx[CpuRegister.Rdi];
+        var nameAddress = ctx[CpuRegister.Rsi];
+        var attr = unchecked((uint)ctx[CpuRegister.Rdx]);
+        var initialCount = unchecked((int)ctx[CpuRegister.Rcx]);
+        var maxCount = unchecked((int)ctx[CpuRegister.R8]);
+        var optionAddress = ctx[CpuRegister.R9];
+
+        if (semaphoreAddress == 0 ||
+            nameAddress == 0 ||
+            attr > 2 ||
+            initialCount < 0 ||
+            maxCount <= 0 ||
+            initialCount > maxCount ||
+            optionAddress != 0)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        if (!TryReadNullTerminatedUtf8(ctx, nameAddress, MaxSemaphoreNameLength, out var name))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        var handle = unchecked((uint)Interlocked.Increment(ref _nextSemaphoreHandle));
+        if (handle == 0)
+        {
+            handle = unchecked((uint)Interlocked.Increment(ref _nextSemaphoreHandle));
+        }
+
+        _semaphores[handle] = new KernelSemaphoreState
+        {
+            Name = name,
+            InitialCount = initialCount,
+            MaxCount = maxCount,
+            Count = initialCount,
+        };
+
+        if (!TryWriteUInt32(ctx, semaphoreAddress, handle))
+        {
+            _semaphores.TryRemove(handle, out _);
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        TraceSemaphore($"create handle=0x{handle:X8} name='{name}' attr=0x{attr:X} init={initialCount} max={maxCount}");
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    [SysAbiExport(
+        Nid = "Zxa0VhQVTsk",
+        ExportName = "sceKernelWaitSema",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelWaitSema(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var needCount = unchecked((int)ctx[CpuRegister.Rsi]);
+        var timeoutAddress = ctx[CpuRegister.Rdx];
+
+        if (!_semaphores.TryGetValue(handle, out var semaphore))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND);
+        }
+
+        if (needCount < 1 || needCount > semaphore.MaxCount)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        lock (semaphore.Gate)
+        {
+            if (semaphore.Count >= needCount)
+            {
+                semaphore.Count -= needCount;
+                TraceSemaphore($"wait handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count}");
+                return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+            }
+
+            if (timeoutAddress != 0)
+            {
+                if (!TryReadUInt32(ctx, timeoutAddress, out _))
+                {
+                    return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+                }
+
+                _ = TryWriteUInt32(ctx, timeoutAddress, 0);
+                TraceSemaphore($"wait-timeout handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count}");
+                return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_TIMED_OUT);
+            }
+
+            if (!GuestThreadExecution.RequestCurrentThreadBlock("sceKernelWaitSema"))
+            {
+                TraceSemaphore($"wait-would-block handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count}");
+                return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_TRY_AGAIN);
+            }
+
+            semaphore.WaitingThreads++;
+            TraceSemaphore($"wait-block handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count} waiters={semaphore.WaitingThreads}");
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+        }
+    }
+
+    [SysAbiExport(
+        Nid = "12wOHk8ywb0",
+        ExportName = "sceKernelPollSema",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelPollSema(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var needCount = unchecked((int)ctx[CpuRegister.Rsi]);
+
+        if (!_semaphores.TryGetValue(handle, out var semaphore))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND);
+        }
+
+        if (needCount < 1 || needCount > semaphore.MaxCount)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        lock (semaphore.Gate)
+        {
+            if (semaphore.Count < needCount)
+            {
+                TraceSemaphore($"poll-busy handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count}");
+                return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_BUSY);
+            }
+
+            semaphore.Count -= needCount;
+            TraceSemaphore($"poll handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count}");
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+        }
+    }
+
+    [SysAbiExport(
+        Nid = "4czppHBiriw",
+        ExportName = "sceKernelSignalSema",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelSignalSema(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var signalCount = unchecked((int)ctx[CpuRegister.Rsi]);
+
+        if (!_semaphores.TryGetValue(handle, out var semaphore))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND);
+        }
+
+        if (signalCount <= 0)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        lock (semaphore.Gate)
+        {
+            if (semaphore.Count > semaphore.MaxCount - signalCount)
+            {
+                return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+            }
+
+            semaphore.Count += signalCount;
+            TraceSemaphore($"signal handle=0x{handle:X8} name='{semaphore.Name}' signal={signalCount} count={semaphore.Count} waiters={semaphore.WaitingThreads}");
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+        }
+    }
+
+    [SysAbiExport(
+        Nid = "4DM06U2BNEY",
+        ExportName = "sceKernelCancelSema",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelCancelSema(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var setCount = unchecked((int)ctx[CpuRegister.Rsi]);
+        var waitingThreadsAddress = ctx[CpuRegister.Rdx];
+
+        if (!_semaphores.TryGetValue(handle, out var semaphore))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND);
+        }
+
+        if (setCount > semaphore.MaxCount)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        lock (semaphore.Gate)
+        {
+            if (waitingThreadsAddress != 0 && !TryWriteUInt32(ctx, waitingThreadsAddress, unchecked((uint)semaphore.WaitingThreads)))
+            {
+                return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+            }
+
+            semaphore.Count = setCount < 0 ? semaphore.InitialCount : setCount;
+            semaphore.WaitingThreads = 0;
+            TraceSemaphore($"cancel handle=0x{handle:X8} name='{semaphore.Name}' set={setCount} count={semaphore.Count}");
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+        }
+    }
+
+    [SysAbiExport(
+        Nid = "R1Jvn8bSCW8",
+        ExportName = "sceKernelDeleteSema",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelDeleteSema(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        if (!_semaphores.TryRemove(handle, out var semaphore))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND);
+        }
+
+        TraceSemaphore($"delete handle=0x{handle:X8} name='{semaphore.Name}'");
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    private static int SetReturn(CpuContext ctx, OrbisGen2Result result)
+    {
+        var value = (int)result;
+        ctx[CpuRegister.Rax] = unchecked((ulong)value);
+        return value;
+    }
+
+    private static bool TryReadUInt32(CpuContext ctx, ulong address, out uint value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(uint)];
+        if (!ctx.Memory.TryRead(address, buffer))
+        {
+            value = 0;
+            return false;
+        }
+
+        value = BinaryPrimitives.ReadUInt32LittleEndian(buffer);
+        return true;
+    }
+
+    private static bool TryWriteUInt32(CpuContext ctx, ulong address, uint value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(uint)];
+        BinaryPrimitives.WriteUInt32LittleEndian(buffer, value);
+        return ctx.Memory.TryWrite(address, buffer);
+    }
+
+    private static bool TryReadNullTerminatedUtf8(CpuContext ctx, ulong address, int maxLength, out string value)
+    {
+        value = string.Empty;
+        if (address == 0 || maxLength <= 0)
+        {
+            return false;
+        }
+
+        var bytes = new byte[Math.Min(maxLength, 4096)];
+        for (var i = 0; i < bytes.Length; i++)
+        {
+            Span<byte> current = stackalloc byte[1];
+            if (!ctx.Memory.TryRead(address + (ulong)i, current))
+            {
+                return false;
+            }
+
+            if (current[0] == 0)
+            {
+                value = Encoding.UTF8.GetString(bytes, 0, i);
+                return true;
+            }
+
+            bytes[i] = current[0];
+        }
+
+        value = Encoding.UTF8.GetString(bytes);
+        return true;
+    }
+
+    private static void TraceSemaphore(string message)
+    {
+        if (string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_SEMA"), "1", StringComparison.Ordinal))
+        {
+            Console.Error.WriteLine($"[LOADER][TRACE] sema.{message}");
+        }
+    }
+}
@@ -0,0 +1,78 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Runtime.InteropServices;
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.LibcInternal;
+
+public static class LibcInternalExports
+{
+    private const ulong HeapTraceInfoSize = 32;
+    private const int HeapTraceTableEntryCount = 64;
+    private const int HeapTraceMaskOffset = 0;
+    private const int HeapTraceTableOffset = HeapTraceMaskOffset + sizeof(ulong);
+    private const int HeapTraceStorageSize = HeapTraceTableOffset + (HeapTraceTableEntryCount * sizeof(ulong));
+
+    private static readonly object _heapTraceGate = new();
+    private static nint _heapTraceStorage;
+
+    [SysAbiExport(
+        Nid = "NWtTN10cJzE",
+        ExportName = "LibcHeapGetTraceInfo",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "LibcInternalExt")]
+    public static int LibcHeapGetTraceInfo(CpuContext ctx)
+    {
+        var infoAddress = ctx[CpuRegister.Rdi];
+        if (infoAddress == 0 || !ctx.TryReadUInt64(infoAddress, out var size) || size != HeapTraceInfoSize)
+        {
+            ctx[CpuRegister.Rax] = 0;
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        var storage = EnsureHeapTraceStorage();
+        if (storage == 0)
+        {
+            ctx[CpuRegister.Rax] = 0;
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        var maskAddress = unchecked((ulong)(storage + HeapTraceMaskOffset));
+        var tableAddress = unchecked((ulong)(storage + HeapTraceTableOffset));
+        if (!ctx.TryWriteUInt64(infoAddress + 16, maskAddress) ||
+            !ctx.TryWriteUInt64(infoAddress + 24, tableAddress))
+        {
+            ctx[CpuRegister.Rax] = 0;
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    private static nint EnsureHeapTraceStorage()
+    {
+        lock (_heapTraceGate)
+        {
+            if (_heapTraceStorage != 0)
+            {
+                return _heapTraceStorage;
+            }
+
+            var storage = Marshal.AllocHGlobal(HeapTraceStorageSize);
+            if (storage == 0)
+            {
+                return 0;
+            }
+
+            unsafe
+            {
+                NativeMemory.Clear((void*)storage, (nuint)HeapTraceStorageSize);
+            }
+
+            _heapTraceStorage = storage;
+            return storage;
+        }
+    }
+}
@@ -0,0 +1,79 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System;
+using System.Collections.Concurrent;
+using System.Threading;
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.Network;
+
+public static class Http2Exports
+{
+    private const int Http2ErrorInvalidId = unchecked((int)0x80436004);
+    private const int Http2ErrorInvalidArgument = unchecked((int)0x80436016);
+
+    private static readonly ConcurrentDictionary<int, Http2Context> _contexts = new();
+    private static int _nextContextId;
+
+    private sealed record Http2Context(int NetId, int SslId, ulong PoolSize, int MaxRequests);
+
+    [SysAbiExport(
+        Nid = "3JCe3lCbQ8A",
+        ExportName = "sceHttp2Init",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceHttp2")]
+    public static int Http2Init(CpuContext ctx)
+    {
+        var netId = unchecked((int)ctx[CpuRegister.Rdi]);
+        var sslId = unchecked((int)ctx[CpuRegister.Rsi]);
+        var poolSize = ctx[CpuRegister.Rdx];
+        var maxRequests = unchecked((int)ctx[CpuRegister.Rcx]);
+
+        if (poolSize == 0 || maxRequests <= 0)
+        {
+            return SetReturn(ctx, Http2ErrorInvalidArgument);
+        }
+
+        var id = Interlocked.Increment(ref _nextContextId);
+        _contexts[id] = new Http2Context(netId, sslId, poolSize, maxRequests);
+
+        TraceHttp2("init", id, unchecked((ulong)netId), unchecked((ulong)sslId), poolSize, unchecked((ulong)maxRequests));
+        ctx[CpuRegister.Rax] = unchecked((ulong)id);
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "YiBUtz-pGkc",
+        ExportName = "sceHttp2Term",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceHttp2")]
+    public static int Http2Term(CpuContext ctx)
+    {
+        var id = unchecked((int)ctx[CpuRegister.Rdi]);
+        if (!_contexts.TryRemove(id, out _))
+        {
+            return SetReturn(ctx, Http2ErrorInvalidId);
+        }
+
+        TraceHttp2("term", id, 0, 0, 0, 0);
+        return SetReturn(ctx, 0);
+    }
+
+    private static int SetReturn(CpuContext ctx, int result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)result);
+        return result;
+    }
+
+    private static void TraceHttp2(string operation, int id, ulong arg0, ulong arg1, ulong arg2, ulong arg3)
+    {
+        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_HTTP2"), "1", StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine(
+            $"[LOADER][TRACE] http2.{operation} id={id} arg0=0x{arg0:X16} arg1=0x{arg1:X16} arg2=0x{arg2:X16} arg3=0x{arg3:X16}");
+    }
+}
@@ -0,0 +1,20 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.Network;
+
+public static class NetCtlExports
+{
+    [SysAbiExport(
+        Nid = "gky0+oaNM4k",
+        ExportName = "sceNetCtlInit",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNetCtl")]
+    public static int NetCtlInit(CpuContext ctx)
+    {
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+}
@@ -0,0 +1,140 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System;
+using System.Collections.Concurrent;
+using System.Text;
+using System.Threading;
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.Network;
+
+public static class NetExports
+{
+    private const int NetErrorBadFileDescriptor = unchecked((int)0x80410109);
+    private const int NetErrorInvalidArgument = unchecked((int)0x80410116);
+    private const int MaxNameLength = 256;
+
+    private static readonly ConcurrentDictionary<int, NetPool> _pools = new();
+    private static int _nextPoolId;
+    private static bool _initialized;
+
+    private sealed record NetPool(string Name, int Size, int Flags);
+
+    [SysAbiExport(
+        Nid = "Nlev7Lg8k3A",
+        ExportName = "sceNetInit",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNet")]
+    public static int NetInit(CpuContext ctx)
+    {
+        _initialized = true;
+        TraceNet("init", 0, 0, 0, 0);
+        return SetReturn(ctx, 0);
+    }
+
+    [SysAbiExport(
+        Nid = "cTGkc6-TBlI",
+        ExportName = "sceNetTerm",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNet")]
+    public static int NetTerm(CpuContext ctx)
+    {
+        _initialized = false;
+        _pools.Clear();
+        TraceNet("term", 0, 0, 0, 0);
+        return SetReturn(ctx, 0);
+    }
+
+    [SysAbiExport(
+        Nid = "dgJBaeJnGpo",
+        ExportName = "sceNetPoolCreate",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNet")]
+    public static int NetPoolCreate(CpuContext ctx)
+    {
+        var nameAddress = ctx[CpuRegister.Rdi];
+        var size = unchecked((int)ctx[CpuRegister.Rsi]);
+        var flags = unchecked((int)ctx[CpuRegister.Rdx]);
+
+        if (size <= 0)
+        {
+            return SetReturn(ctx, NetErrorInvalidArgument);
+        }
+
+        var name = TryReadUtf8Z(ctx, nameAddress, MaxNameLength, out var value)
+            ? value
+            : string.Empty;
+
+        var id = Interlocked.Increment(ref _nextPoolId);
+        _pools[id] = new NetPool(name, size, flags);
+
+        TraceNet("pool.create", id, unchecked((ulong)size), unchecked((ulong)flags), _initialized ? 1UL : 0UL);
+        ctx[CpuRegister.Rax] = unchecked((ulong)id);
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "K7RlrTkI-mw",
+        ExportName = "sceNetPoolDestroy",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNet")]
+    public static int NetPoolDestroy(CpuContext ctx)
+    {
+        var id = unchecked((int)ctx[CpuRegister.Rdi]);
+        if (!_pools.TryRemove(id, out _))
+        {
+            return SetReturn(ctx, NetErrorBadFileDescriptor);
+        }
+
+        TraceNet("pool.destroy", id, 0, 0, _initialized ? 1UL : 0UL);
+        return SetReturn(ctx, 0);
+    }
+
+    private static int SetReturn(CpuContext ctx, int result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)result);
+        return result;
+    }
+
+    private static bool TryReadUtf8Z(CpuContext ctx, ulong address, int maxLength, out string value)
+    {
+        value = string.Empty;
+        if (address == 0)
+        {
+            return true;
+        }
+
+        Span<byte> one = stackalloc byte[1];
+        var bytes = new byte[maxLength];
+        var count = 0;
+        for (; count < maxLength; count++)
+        {
+            if (!ctx.Memory.TryRead(address + (ulong)count, one))
+            {
+                return false;
+            }
+
+            if (one[0] == 0)
+            {
+                break;
+            }
+
+            bytes[count] = one[0];
+        }
+
+        value = Encoding.UTF8.GetString(bytes, 0, count);
+        return true;
+    }
+
+    private static void TraceNet(string operation, int id, ulong arg0, ulong arg1, ulong arg2)
+    {
+        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_NET"), "1", StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine(
+            $"[LOADER][TRACE] net.{operation} id={id} arg0=0x{arg0:X16} arg1=0x{arg1:X16} arg2=0x{arg2:X16}");
+    }
+}
@@ -0,0 +1,87 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System;
+using System.Collections.Concurrent;
+using System.Threading;
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.Network;
+
+public static class SslExports
+{
+    private const int SslErrorInvalidId = unchecked((int)0x8095F006);
+    private const int SslErrorOutOfSize = unchecked((int)0x8095F008);
+
+    private static readonly ConcurrentDictionary<int, SslContext> _contexts = new();
+    private static int _nextContextId;
+
+    private sealed record SslContext(ulong PoolSize);
+
+    [SysAbiExport(
+        Nid = "hdpVEUDFW3s",
+        ExportName = "sceSslInit",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceSsl")]
+    public static int SslInit(CpuContext ctx)
+    {
+        var poolSize = ctx[CpuRegister.Rdi];
+        if (poolSize == 0)
+        {
+            return SetReturn(ctx, SslErrorOutOfSize);
+        }
+
+        var id = Interlocked.Increment(ref _nextContextId);
+        _contexts[id] = new SslContext(poolSize);
+
+        TraceSsl("init", id, poolSize);
+        ctx[CpuRegister.Rax] = unchecked((ulong)id);
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "0K1yQ6Lv-Yc",
+        ExportName = "sceSslTerm",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceSsl")]
+    public static int SslTerm(CpuContext ctx)
+    {
+        var id = unchecked((int)ctx[CpuRegister.Rdi]);
+        if (!_contexts.TryRemove(id, out _))
+        {
+            return SetReturn(ctx, SslErrorInvalidId);
+        }
+
+        TraceSsl("term", id, 0);
+        return SetReturn(ctx, 0);
+    }
+
+    [SysAbiExport(
+        Nid = "viRXSHZYd0c",
+        ExportName = "sceSslClose",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceSsl")]
+    public static int SslClose(CpuContext ctx)
+    {
+        var id = unchecked((int)ctx[CpuRegister.Rdi]);
+        TraceSsl("close", id, 0);
+        return SetReturn(ctx, 0);
+    }
+
+    private static int SetReturn(CpuContext ctx, int result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)result);
+        return result;
+    }
+
+    private static void TraceSsl(string operation, int id, ulong arg0)
+    {
+        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_SSL"), "1", StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine(
+            $"[LOADER][TRACE] ssl.{operation} id={id} arg0=0x{arg0:X16}");
+    }
+}
@@ -0,0 +1,67 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.Np;
+
+public static class NpManagerExports
+{
+    private const int NpTitleIdSize = 16;
+    private const int NpTitleSecretSize = 128;
+
+    [SysAbiExport(
+        Nid = "Ec63y59l9tw",
+        ExportName = "sceNpSetNpTitleId",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNpManager")]
+    public static int NpSetNpTitleId(CpuContext ctx)
+    {
+        var titleIdAddress = ctx[CpuRegister.Rdi];
+        var titleSecretAddress = ctx[CpuRegister.Rsi];
+        if (titleIdAddress == 0 || titleSecretAddress == 0)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        Span<byte> titleId = stackalloc byte[NpTitleIdSize];
+        Span<byte> titleSecret = stackalloc byte[NpTitleSecretSize];
+        if (!ctx.Memory.TryRead(titleIdAddress, titleId) ||
+            !ctx.Memory.TryRead(titleSecretAddress, titleSecret))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        TraceNp($"set_np_title_id title='{ReadTitleId(titleId)}'");
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    private static int SetReturn(CpuContext ctx, OrbisGen2Result result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)(int)result);
+        return (int)result;
+    }
+
+    private static string ReadTitleId(ReadOnlySpan<byte> bytes)
+    {
+        var length = 0;
+        while (length < 12 && length < bytes.Length && bytes[length] != 0)
+        {
+            length++;
+        }
+
+        return length == 0
+            ? string.Empty
+            : System.Text.Encoding.ASCII.GetString(bytes[..length]);
+    }
+
+    private static void TraceNp(string message)
+    {
+        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_NP"), "1", StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine($"[LOADER][TRACE] np.{message}");
+    }
+}
@@ -0,0 +1,65 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System;
+using System.Threading;
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.Np;
+
+public static class NpWebApi2Exports
+{
+    private const int NpWebApi2ErrorInvalidArgument = unchecked((int)0x80553402);
+
+    private static int _initialized;
+
+    [SysAbiExport(
+        Nid = "+o9816YQhqQ",
+        ExportName = "sceNpWebApi2Initialize",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNpWebApi2")]
+    public static int NpWebApi2Initialize(CpuContext ctx)
+    {
+        var httpContextId = unchecked((int)ctx[CpuRegister.Rdi]);
+        var poolSize = ctx[CpuRegister.Rsi];
+
+        if (httpContextId <= 0 || poolSize == 0)
+        {
+            return SetReturn(ctx, NpWebApi2ErrorInvalidArgument);
+        }
+
+        Interlocked.Exchange(ref _initialized, 1);
+        TraceNpWebApi2("init", httpContextId, poolSize);
+        return SetReturn(ctx, 0);
+    }
+
+    [SysAbiExport(
+        Nid = "bEvXpcEk200",
+        ExportName = "sceNpWebApi2Terminate",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNpWebApi2")]
+    public static int NpWebApi2Terminate(CpuContext ctx)
+    {
+        var libraryContextId = unchecked((int)ctx[CpuRegister.Rdi]);
+        Interlocked.Exchange(ref _initialized, 0);
+        TraceNpWebApi2("term", libraryContextId, 0);
+        return SetReturn(ctx, 0);
+    }
+
+    private static int SetReturn(CpuContext ctx, int result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)result);
+        return result;
+    }
+
+    private static void TraceNpWebApi2(string operation, int id, ulong arg0)
+    {
+        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_NP_WEB_API2"), "1", StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine(
+            $"[LOADER][TRACE] npwebapi2.{operation} id={id} arg0=0x{arg0:X16} initialized={Volatile.Read(ref _initialized)}");
+    }
+}
@@ -0,0 +1,24 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Threading;
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.NpGameIntent;
+
+public static class NpGameIntentExports
+{
+    private static int _initialized;
+
+    [SysAbiExport(
+        Nid = "m87BHxt-H60",
+        ExportName = "sceNpGameIntentInitialize",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNpGameIntent")]
+    public static int NpGameIntentInitialize(CpuContext ctx)
+    {
+        Interlocked.Exchange(ref _initialized, 1);
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+}
@@ -0,0 +1,158 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+using System.Buffers.Binary;
+using System.Diagnostics;
+
+namespace SharpEmu.Libs.Pad;
+
+public static class PadExports
+{
+    private const int OrbisPadErrorInvalidHandle = unchecked((int)0x80920003);
+    private const int OrbisPadErrorNotInitialized = unchecked((int)0x80920005);
+    private const int OrbisPadErrorDeviceNotConnected = unchecked((int)0x80920007);
+    private const int OrbisPadErrorDeviceNoHandle = unchecked((int)0x80920008);
+    private const int PrimaryUserId = 1;
+    private const int StandardPortType = 0;
+    private const int PrimaryPadHandle = 1;
+    private const int ControllerInformationSize = 0x1C;
+    private const int PadDataSize = 0x78;
+
+    private static bool _initialized;
+
+    [SysAbiExport(
+        Nid = "hv1luiJrqQM",
+        ExportName = "scePadInit",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePad")]
+    public static int PadInit(CpuContext ctx)
+    {
+        _initialized = true;
+        return SetReturn(ctx, 0);
+    }
+
+    [SysAbiExport(
+        Nid = "xk0AcarP3V4",
+        ExportName = "scePadOpen",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePad")]
+    public static int PadOpen(CpuContext ctx)
+    {
+        var userId = unchecked((int)ctx[CpuRegister.Rdi]);
+        var type = unchecked((int)ctx[CpuRegister.Rsi]);
+        var index = unchecked((int)ctx[CpuRegister.Rdx]);
+        var parameterAddress = ctx[CpuRegister.Rcx];
+        if (!_initialized)
+        {
+            return SetReturn(ctx, OrbisPadErrorNotInitialized);
+        }
+
+        if (userId == -1)
+        {
+            return SetReturn(ctx, OrbisPadErrorDeviceNoHandle);
+        }
+
+        if (userId != PrimaryUserId || type != StandardPortType || index != 0 || parameterAddress != 0)
+        {
+            return SetReturn(ctx, OrbisPadErrorDeviceNotConnected);
+        }
+
+        return SetReturn(ctx, PrimaryPadHandle);
+    }
+
+    [SysAbiExport(
+        Nid = "clVvL4ZDntw",
+        ExportName = "scePadSetMotionSensorState",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePad")]
+    public static int PadSetMotionSensorState(CpuContext ctx)
+    {
+        var handle = unchecked((int)ctx[CpuRegister.Rdi]);
+        return handle == PrimaryPadHandle
+            ? SetReturn(ctx, 0)
+            : SetReturn(ctx, OrbisPadErrorInvalidHandle);
+    }
+
+    [SysAbiExport(
+        Nid = "gjP9-KQzoUk",
+        ExportName = "scePadGetControllerInformation",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePad")]
+    public static int PadGetControllerInformation(CpuContext ctx)
+    {
+        var handle = unchecked((int)ctx[CpuRegister.Rdi]);
+        var informationAddress = ctx[CpuRegister.Rsi];
+        if (handle != PrimaryPadHandle)
+        {
+            return SetReturn(ctx, OrbisPadErrorInvalidHandle);
+        }
+
+        if (informationAddress == 0)
+        {
+            return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        Span<byte> information = stackalloc byte[ControllerInformationSize];
+        BinaryPrimitives.WriteSingleLittleEndian(information[0x00..], 44.86f);
+        BinaryPrimitives.WriteUInt16LittleEndian(information[0x04..], 1920);
+        BinaryPrimitives.WriteUInt16LittleEndian(information[0x06..], 943);
+        information[0x08] = 30;
+        information[0x09] = 30;
+        information[0x0A] = StandardPortType;
+        information[0x0B] = 1;
+        information[0x0C] = 1;
+        BinaryPrimitives.WriteInt32LittleEndian(information[0x10..], 0);
+
+        return ctx.Memory.TryWrite(informationAddress, information)
+            ? SetReturn(ctx, 0)
+            : SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+    }
+
+    [SysAbiExport(
+        Nid = "YndgXqQVV7c",
+        ExportName = "scePadReadState",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePad")]
+    public static int PadReadState(CpuContext ctx)
+    {
+        var handle = unchecked((int)ctx[CpuRegister.Rdi]);
+        var dataAddress = ctx[CpuRegister.Rsi];
+        if (handle != PrimaryPadHandle)
+        {
+            return SetReturn(ctx, OrbisPadErrorInvalidHandle);
+        }
+
+        if (dataAddress == 0)
+        {
+            return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        Span<byte> data = stackalloc byte[PadDataSize];
+        data.Clear();
+        data[0x04] = 128;
+        data[0x05] = 128;
+        data[0x06] = 128;
+        data[0x07] = 128;
+        BinaryPrimitives.WriteSingleLittleEndian(data[0x18..], 1.0f);
+        data[0x4C] = 1;
+        var timestampTicks = Stopwatch.GetTimestamp();
+        var timestampMicroseconds =
+            ((ulong)(timestampTicks / Stopwatch.Frequency) * 1_000_000UL) +
+            ((ulong)(timestampTicks % Stopwatch.Frequency) * 1_000_000UL / (ulong)Stopwatch.Frequency);
+        BinaryPrimitives.WriteUInt64LittleEndian(
+            data[0x50..],
+            timestampMicroseconds);
+        data[0x68] = 1;
+
+        return ctx.Memory.TryWrite(dataAddress, data)
+            ? SetReturn(ctx, 0)
+            : SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+    }
+
+    private static int SetReturn(CpuContext ctx, int result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)result);
+        return result;
+    }
+}
@@ -0,0 +1,750 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+using System.Buffers.Binary;
+using System.Text.RegularExpressions;
+
+namespace SharpEmu.Libs.PlayGo;
+
+public static class PlayGoExports
+{
+    private const int OrbisPlayGoErrorInvalidArgument = unchecked((int)0x80B20004);
+    private const int OrbisPlayGoErrorNotInitialized = unchecked((int)0x80B20005);
+    private const int OrbisPlayGoErrorAlreadyInitialized = unchecked((int)0x80B20006);
+    private const int OrbisPlayGoErrorBadHandle = unchecked((int)0x80B20009);
+    private const int OrbisPlayGoErrorBadPointer = unchecked((int)0x80B2000A);
+    private const int OrbisPlayGoErrorBadSize = unchecked((int)0x80B2000B);
+    private const int OrbisPlayGoErrorBadChunkId = unchecked((int)0x80B2000C);
+    private const int OrbisPlayGoErrorNotSupportPlayGo = unchecked((int)0x80B2000E);
+    private const int OrbisPlayGoErrorBadLocus = unchecked((int)0x80B20010);
+    private const ulong PlayGoInitBufAddrOffset = 0;
+    private const ulong PlayGoInitBufSizeOffset = 8;
+    private const uint PlayGoMinimumInitBufferSize = 0x200000;
+    private const uint PlayGoHandle = 1;
+    private const int PlayGoLocusNotDownloaded = 0;
+    private const int PlayGoLocusLocalSlow = 2;
+    private const int PlayGoLocusLocalFast = 3;
+    private const int PlayGoInstallSpeedSuspended = 0;
+    private const int PlayGoInstallSpeedTrickle = 1;
+    private const int PlayGoInstallSpeedFull = 2;
+    private const uint MaxPlayGoQueryEntries = 0x4000;
+
+    private static readonly Regex ChunkIdPattern = new(
+        @"<chunk\s+[^>]*\bid\s*=\s*""(?<id>\d+)""",
+        RegexOptions.CultureInvariant);
+
+    private static readonly Regex DefaultChunkPattern = new(
+        @"default_chunk\s*=\s*""(?<id>\d+)""",
+        RegexOptions.CultureInvariant);
+
+    private static readonly object _stateGate = new();
+    private static bool _initialized;
+    private static bool _opened;
+    private static PlayGoMetadata _metadata = PlayGoMetadata.Empty;
+    private static int _installSpeed = PlayGoInstallSpeedTrickle;
+    private static ulong _languageMask = ulong.MaxValue;
+
+    [SysAbiExport(
+        Nid = "ts6GlZOKRrE",
+        ExportName = "scePlayGoInitialize",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePlayGo")]
+    public static int PlayGoInitialize(CpuContext ctx)
+    {
+        var initParamsAddress = ctx[CpuRegister.Rdi];
+        if (initParamsAddress == 0)
+        {
+            return OrbisPlayGoErrorBadPointer;
+        }
+
+        if (!ctx.TryReadUInt64(initParamsAddress + PlayGoInitBufAddrOffset, out var bufferAddress))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        Span<byte> bufferSizeBytes = stackalloc byte[sizeof(uint)];
+        if (!ctx.Memory.TryRead(initParamsAddress + PlayGoInitBufSizeOffset, bufferSizeBytes))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        var bufferSize = BinaryPrimitives.ReadUInt32LittleEndian(bufferSizeBytes);
+
+        if (bufferAddress == 0)
+        {
+            return OrbisPlayGoErrorBadPointer;
+        }
+
+        if (bufferSize < PlayGoMinimumInitBufferSize)
+        {
+            return OrbisPlayGoErrorBadSize;
+        }
+
+        lock (_stateGate)
+        {
+            if (_initialized)
+            {
+                return OrbisPlayGoErrorAlreadyInitialized;
+            }
+
+            _metadata = LoadPlayGoMetadata();
+            _installSpeed = PlayGoInstallSpeedTrickle;
+            _languageMask = ulong.MaxValue;
+            _opened = false;
+            _initialized = true;
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "M1Gma1ocrGE",
+        ExportName = "scePlayGoOpen",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePlayGo")]
+    public static int PlayGoOpen(CpuContext ctx)
+    {
+        var outHandleAddress = ctx[CpuRegister.Rdi];
+        var paramAddress = ctx[CpuRegister.Rsi];
+        if (outHandleAddress == 0)
+        {
+            return OrbisPlayGoErrorBadPointer;
+        }
+
+        if (paramAddress != 0)
+        {
+            return OrbisPlayGoErrorInvalidArgument;
+        }
+
+        lock (_stateGate)
+        {
+            if (!_initialized)
+            {
+                return OrbisPlayGoErrorNotInitialized;
+            }
+
+            if (!_metadata.Available)
+            {
+                return OrbisPlayGoErrorNotSupportPlayGo;
+            }
+
+            _opened = true;
+        }
+
+        Span<byte> handleBytes = stackalloc byte[sizeof(uint)];
+        BinaryPrimitives.WriteUInt32LittleEndian(handleBytes, PlayGoHandle);
+        if (!ctx.Memory.TryWrite(outHandleAddress, handleBytes))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "MPe0EeBGM-E",
+        ExportName = "scePlayGoTerminate",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePlayGo")]
+    public static int PlayGoTerminate(CpuContext ctx)
+    {
+        _ = ctx;
+        lock (_stateGate)
+        {
+            if (!_initialized)
+            {
+                return OrbisPlayGoErrorNotInitialized;
+            }
+
+            _initialized = false;
+            _opened = false;
+            _metadata = PlayGoMetadata.Empty;
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "Uco1I0dlDi8",
+        ExportName = "scePlayGoClose",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePlayGo")]
+    public static int PlayGoClose(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        lock (_stateGate)
+        {
+            if (!_initialized)
+            {
+                return OrbisPlayGoErrorNotInitialized;
+            }
+
+            if (handle != PlayGoHandle)
+            {
+                return OrbisPlayGoErrorBadHandle;
+            }
+
+            _opened = false;
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "73fF1MFU8hA",
+        ExportName = "scePlayGoGetChunkId",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePlayGo")]
+    public static int PlayGoGetChunkId(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var outChunkIdList = ctx[CpuRegister.Rsi];
+        var numberOfEntries = unchecked((uint)ctx[CpuRegister.Rdx]);
+        var outEntries = ctx[CpuRegister.Rcx];
+
+        var validation = ValidateHandle(handle);
+        if (validation != 0)
+        {
+            return validation;
+        }
+
+        if (outEntries == 0)
+        {
+            return OrbisPlayGoErrorBadPointer;
+        }
+
+        if (outChunkIdList != 0 && numberOfEntries == 0)
+        {
+            return OrbisPlayGoErrorBadSize;
+        }
+
+        ushort[] chunkIds;
+        lock (_stateGate)
+        {
+            chunkIds = _metadata.ChunkIds;
+        }
+
+        var availableEntries = chunkIds.Length == 0 ? 1u : (uint)chunkIds.Length;
+        if (outChunkIdList == 0)
+        {
+            return TryWriteUInt32(ctx, outEntries, availableEntries)
+                ? (int)OrbisGen2Result.ORBIS_GEN2_OK
+                : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        var entriesToWrite = Math.Min(numberOfEntries, availableEntries);
+        if (entriesToWrite > MaxPlayGoQueryEntries)
+        {
+            return OrbisPlayGoErrorBadSize;
+        }
+
+        for (uint i = 0; i < entriesToWrite; i++)
+        {
+            var chunkId = chunkIds.Length == 0 ? (ushort)0 : chunkIds[i];
+            if (!TryWriteUInt16(ctx, outChunkIdList + (i * sizeof(ushort)), chunkId))
+            {
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+            }
+        }
+
+        return TryWriteUInt32(ctx, outEntries, entriesToWrite)
+            ? (int)OrbisGen2Result.ORBIS_GEN2_OK
+            : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+    }
+
+    [SysAbiExport(
+        Nid = "v6EZ-YWRdMs",
+        ExportName = "scePlayGoGetEta",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePlayGo")]
+    public static int PlayGoGetEta(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var chunkIds = ctx[CpuRegister.Rsi];
+        var numberOfEntries = unchecked((uint)ctx[CpuRegister.Rdx]);
+        var outEta = ctx[CpuRegister.Rcx];
+
+        var validation = ValidateHandle(handle);
+        if (validation != 0)
+        {
+            return validation;
+        }
+
+        if (chunkIds == 0 || outEta == 0)
+        {
+            return OrbisPlayGoErrorBadPointer;
+        }
+
+        if (numberOfEntries == 0 || numberOfEntries > MaxPlayGoQueryEntries)
+        {
+            return OrbisPlayGoErrorBadSize;
+        }
+
+        return ValidateChunkIds(ctx, chunkIds, numberOfEntries) is { } chunkError && chunkError != 0
+            ? chunkError
+            : TryWriteInt64(ctx, outEta, 0)
+                ? (int)OrbisGen2Result.ORBIS_GEN2_OK
+                : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+    }
+
+    [SysAbiExport(
+        Nid = "rvBSfTimejE",
+        ExportName = "scePlayGoGetInstallSpeed",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePlayGo")]
+    public static int PlayGoGetInstallSpeed(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var outSpeed = ctx[CpuRegister.Rsi];
+
+        var validation = ValidateHandle(handle);
+        if (validation != 0)
+        {
+            return validation;
+        }
+
+        if (outSpeed == 0)
+        {
+            return OrbisPlayGoErrorBadPointer;
+        }
+
+        int speed;
+        lock (_stateGate)
+        {
+            speed = _installSpeed;
+        }
+
+        return TryWriteInt32(ctx, outSpeed, speed)
+            ? (int)OrbisGen2Result.ORBIS_GEN2_OK
+            : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+    }
+
+    [SysAbiExport(
+        Nid = "3OMbYZBaa50",
+        ExportName = "scePlayGoGetLanguageMask",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePlayGo")]
+    public static int PlayGoGetLanguageMask(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var outLanguageMask = ctx[CpuRegister.Rsi];
+
+        var validation = ValidateHandle(handle);
+        if (validation != 0)
+        {
+            return validation;
+        }
+
+        if (outLanguageMask == 0)
+        {
+            return OrbisPlayGoErrorBadPointer;
+        }
+
+        ulong languageMask;
+        lock (_stateGate)
+        {
+            languageMask = _languageMask;
+        }
+
+        return ctx.TryWriteUInt64(outLanguageMask, languageMask)
+            ? (int)OrbisGen2Result.ORBIS_GEN2_OK
+            : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+    }
+
+    [SysAbiExport(
+        Nid = "uWIYLFkkwqk",
+        ExportName = "scePlayGoGetLocus",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePlayGo")]
+    public static int PlayGoGetLocus(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var chunkIds = ctx[CpuRegister.Rsi];
+        var numberOfEntries = unchecked((uint)ctx[CpuRegister.Rdx]);
+        var outLoci = ctx[CpuRegister.Rcx];
+
+        var validation = ValidateHandle(handle);
+        if (validation != 0)
+        {
+            return validation;
+        }
+
+        if (chunkIds == 0 || outLoci == 0)
+        {
+            return OrbisPlayGoErrorBadPointer;
+        }
+
+        if (numberOfEntries == 0 || numberOfEntries > MaxPlayGoQueryEntries)
+        {
+            return OrbisPlayGoErrorBadSize;
+        }
+
+        var loci = new byte[numberOfEntries];
+        for (uint i = 0; i < numberOfEntries; i++)
+        {
+            if (!TryReadUInt16(ctx, chunkIds + (i * sizeof(ushort)), out var chunkId))
+            {
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+            }
+
+            if (!IsKnownChunkId(chunkId))
+            {
+                loci[i] = PlayGoLocusNotDownloaded;
+                return ctx.Memory.TryWrite(outLoci, loci)
+                    ? OrbisPlayGoErrorBadChunkId
+                    : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+            }
+
+            loci[i] = PlayGoLocusLocalFast;
+        }
+
+        return ctx.Memory.TryWrite(outLoci, loci)
+            ? (int)OrbisGen2Result.ORBIS_GEN2_OK
+            : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+    }
+
+    [SysAbiExport(
+        Nid = "-RJWNMK3fC8",
+        ExportName = "scePlayGoGetProgress",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePlayGo")]
+    public static int PlayGoGetProgress(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var chunkIds = ctx[CpuRegister.Rsi];
+        var numberOfEntries = unchecked((uint)ctx[CpuRegister.Rdx]);
+        var outProgress = ctx[CpuRegister.Rcx];
+
+        var validation = ValidateHandle(handle);
+        if (validation != 0)
+        {
+            return validation;
+        }
+
+        if (chunkIds == 0 || outProgress == 0)
+        {
+            return OrbisPlayGoErrorBadPointer;
+        }
+
+        if (numberOfEntries == 0 || numberOfEntries > MaxPlayGoQueryEntries)
+        {
+            return OrbisPlayGoErrorBadSize;
+        }
+
+        var chunkError = ValidateChunkIds(ctx, chunkIds, numberOfEntries);
+        if (chunkError != 0)
+        {
+            return chunkError;
+        }
+
+        Span<byte> progress = stackalloc byte[sizeof(ulong) * 2];
+        BinaryPrimitives.WriteUInt64LittleEndian(progress, 0);
+        BinaryPrimitives.WriteUInt64LittleEndian(progress[sizeof(ulong)..], 0);
+        return ctx.Memory.TryWrite(outProgress, progress)
+            ? (int)OrbisGen2Result.ORBIS_GEN2_OK
+            : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+    }
+
+    [SysAbiExport(
+        Nid = "Nn7zKwnA5q0",
+        ExportName = "scePlayGoGetToDoList",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePlayGo")]
+    public static int PlayGoGetToDoList(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var outTodoList = ctx[CpuRegister.Rsi];
+        var numberOfEntries = unchecked((uint)ctx[CpuRegister.Rdx]);
+        var outEntries = ctx[CpuRegister.Rcx];
+
+        var validation = ValidateHandle(handle);
+        if (validation != 0)
+        {
+            return validation;
+        }
+
+        if (outTodoList == 0 || outEntries == 0)
+        {
+            return OrbisPlayGoErrorBadPointer;
+        }
+
+        if (numberOfEntries == 0)
+        {
+            return OrbisPlayGoErrorBadSize;
+        }
+
+        return TryWriteUInt32(ctx, outEntries, 0)
+            ? (int)OrbisGen2Result.ORBIS_GEN2_OK
+            : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+    }
+
+    [SysAbiExport(
+        Nid = "-Q1-u1a7p0g",
+        ExportName = "scePlayGoPrefetch",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePlayGo")]
+    public static int PlayGoPrefetch(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var chunkIds = ctx[CpuRegister.Rsi];
+        var numberOfEntries = unchecked((uint)ctx[CpuRegister.Rdx]);
+        var minimumLocus = unchecked((int)ctx[CpuRegister.Rcx]);
+
+        var validation = ValidateHandle(handle);
+        if (validation != 0)
+        {
+            return validation;
+        }
+
+        if (chunkIds == 0)
+        {
+            return OrbisPlayGoErrorBadPointer;
+        }
+
+        if (numberOfEntries == 0 || numberOfEntries > MaxPlayGoQueryEntries)
+        {
+            return OrbisPlayGoErrorBadSize;
+        }
+
+        if (minimumLocus is not PlayGoLocusNotDownloaded and not PlayGoLocusLocalSlow and not PlayGoLocusLocalFast)
+        {
+            return OrbisPlayGoErrorBadLocus;
+        }
+
+        return ValidateChunkIds(ctx, chunkIds, numberOfEntries) is { } chunkError && chunkError != 0
+            ? chunkError
+            : (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "4AAcTU9R3XM",
+        ExportName = "scePlayGoSetInstallSpeed",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePlayGo")]
+    public static int PlayGoSetInstallSpeed(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var speed = unchecked((int)ctx[CpuRegister.Rsi]);
+
+        var validation = ValidateHandle(handle);
+        if (validation != 0)
+        {
+            return validation;
+        }
+
+        if (speed is not PlayGoInstallSpeedSuspended and not PlayGoInstallSpeedTrickle and not PlayGoInstallSpeedFull)
+        {
+            return OrbisPlayGoErrorInvalidArgument;
+        }
+
+        lock (_stateGate)
+        {
+            _installSpeed = speed;
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "LosLlHOpNqQ",
+        ExportName = "scePlayGoSetLanguageMask",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePlayGo")]
+    public static int PlayGoSetLanguageMask(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var languageMask = ctx[CpuRegister.Rsi];
+
+        var validation = ValidateHandle(handle);
+        if (validation != 0)
+        {
+            return validation;
+        }
+
+        lock (_stateGate)
+        {
+            _languageMask = languageMask;
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "gUPGiOQ1tmQ",
+        ExportName = "scePlayGoSetToDoList",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePlayGo")]
+    public static int PlayGoSetToDoList(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var todoList = ctx[CpuRegister.Rsi];
+        var numberOfEntries = unchecked((uint)ctx[CpuRegister.Rdx]);
+
+        var validation = ValidateHandle(handle);
+        if (validation != 0)
+        {
+            return validation;
+        }
+
+        if (todoList == 0)
+        {
+            return OrbisPlayGoErrorBadPointer;
+        }
+
+        return numberOfEntries == 0
+            ? OrbisPlayGoErrorBadSize
+            : (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    private static int ValidateHandle(uint handle)
+    {
+        lock (_stateGate)
+        {
+            if (!_initialized)
+            {
+                return OrbisPlayGoErrorNotInitialized;
+            }
+
+            if (handle != PlayGoHandle || !_opened)
+            {
+                return OrbisPlayGoErrorBadHandle;
+            }
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    private static int ValidateChunkIds(CpuContext ctx, ulong chunkIds, uint numberOfEntries)
+    {
+        for (uint i = 0; i < numberOfEntries; i++)
+        {
+            if (!TryReadUInt16(ctx, chunkIds + (i * sizeof(ushort)), out var chunkId))
+            {
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+            }
+
+            if (!IsKnownChunkId(chunkId))
+            {
+                return OrbisPlayGoErrorBadChunkId;
+            }
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    private static bool IsKnownChunkId(ushort chunkId)
+    {
+        lock (_stateGate)
+        {
+            return _metadata.ChunkIds.Length == 0 || Array.BinarySearch(_metadata.ChunkIds, chunkId) >= 0;
+        }
+    }
+
+    private static PlayGoMetadata LoadPlayGoMetadata()
+    {
+        var app0Root = Environment.GetEnvironmentVariable("SHARPEMU_APP0_DIR");
+        if (string.IsNullOrWhiteSpace(app0Root))
+        {
+            return PlayGoMetadata.Empty;
+        }
+
+        var playGoDat = Path.Combine(app0Root, "sce_sys", "playgo-chunk.dat");
+        var scenarioJson = Path.Combine(app0Root, "sce_sys", "playgo-scenario.json");
+        var chunkDefsXml = Path.Combine(app0Root, "playgo-chunkdefs.xml");
+
+        var hasMetadata = File.Exists(playGoDat) || File.Exists(scenarioJson) || File.Exists(chunkDefsXml);
+        if (!hasMetadata)
+        {
+            return PlayGoMetadata.Empty;
+        }
+
+        var chunkIds = LoadChunkIds(chunkDefsXml);
+        return new PlayGoMetadata(true, chunkIds);
+    }
+
+    private static ushort[] LoadChunkIds(string chunkDefsXml)
+    {
+        if (!File.Exists(chunkDefsXml))
+        {
+            return Array.Empty<ushort>();
+        }
+
+        try
+        {
+            var xml = File.ReadAllText(chunkDefsXml);
+            var chunkIds = new HashSet<ushort>();
+            AddChunkIds(xml, DefaultChunkPattern, chunkIds);
+            AddChunkIds(xml, ChunkIdPattern, chunkIds);
+
+            var sorted = chunkIds.ToArray();
+            Array.Sort(sorted);
+            return sorted;
+        }
+        catch (IOException)
+        {
+            return Array.Empty<ushort>();
+        }
+        catch (UnauthorizedAccessException)
+        {
+            return Array.Empty<ushort>();
+        }
+    }
+
+    private static void AddChunkIds(string xml, Regex pattern, HashSet<ushort> chunkIds)
+    {
+        foreach (Match match in pattern.Matches(xml))
+        {
+            if (ushort.TryParse(match.Groups["id"].Value, out var chunkId))
+            {
+                chunkIds.Add(chunkId);
+            }
+        }
+    }
+
+    private static bool TryReadUInt16(CpuContext ctx, ulong address, out ushort value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(ushort)];
+        if (!ctx.Memory.TryRead(address, buffer))
+        {
+            value = 0;
+            return false;
+        }
+
+        value = BinaryPrimitives.ReadUInt16LittleEndian(buffer);
+        return true;
+    }
+
+    private static bool TryWriteUInt16(CpuContext ctx, ulong address, ushort value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(ushort)];
+        BinaryPrimitives.WriteUInt16LittleEndian(buffer, value);
+        return ctx.Memory.TryWrite(address, buffer);
+    }
+
+    private static bool TryWriteUInt32(CpuContext ctx, ulong address, uint value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(uint)];
+        BinaryPrimitives.WriteUInt32LittleEndian(buffer, value);
+        return ctx.Memory.TryWrite(address, buffer);
+    }
+
+    private static bool TryWriteInt32(CpuContext ctx, ulong address, int value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(int)];
+        BinaryPrimitives.WriteInt32LittleEndian(buffer, value);
+        return ctx.Memory.TryWrite(address, buffer);
+    }
+
+    private static bool TryWriteInt64(CpuContext ctx, ulong address, long value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(long)];
+        BinaryPrimitives.WriteInt64LittleEndian(buffer, value);
+        return ctx.Memory.TryWrite(address, buffer);
+    }
+
+    private sealed record PlayGoMetadata(bool Available, ushort[] ChunkIds)
+    {
+        public static readonly PlayGoMetadata Empty = new(false, Array.Empty<ushort>());
+    }
+}
@@ -0,0 +1,119 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+using System.Buffers.Binary;
+
+namespace SharpEmu.Libs.Rtc;
+
+public static class RtcExports
+{
+    [SysAbiExport(
+        Nid = "ZPD1YOKI+Kw",
+        ExportName = "sceRtcGetCurrentClockLocalTime",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcGetCurrentClockLocalTime(CpuContext ctx)
+    {
+        var timeAddress = ctx[CpuRegister.Rdi];
+        if (timeAddress == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        var now = DateTimeOffset.Now;
+        Span<byte> rtcDateTime = stackalloc byte[16];
+        BinaryPrimitives.WriteUInt16LittleEndian(rtcDateTime[0..2], checked((ushort)now.Year));
+        BinaryPrimitives.WriteUInt16LittleEndian(rtcDateTime[2..4], checked((ushort)now.Month));
+        BinaryPrimitives.WriteUInt16LittleEndian(rtcDateTime[4..6], checked((ushort)now.Day));
+        BinaryPrimitives.WriteUInt16LittleEndian(rtcDateTime[6..8], checked((ushort)now.Hour));
+        BinaryPrimitives.WriteUInt16LittleEndian(rtcDateTime[8..10], checked((ushort)now.Minute));
+        BinaryPrimitives.WriteUInt16LittleEndian(rtcDateTime[10..12], checked((ushort)now.Second));
+        BinaryPrimitives.WriteUInt32LittleEndian(
+            rtcDateTime[12..16],
+            checked((uint)((now.Ticks % TimeSpan.TicksPerSecond) / 10)));
+
+        if (!ctx.Memory.TryWrite(timeAddress, rtcDateTime))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "8w-H19ip48I",
+        ExportName = "sceRtcGetTick",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceRtc")]
+    public static int RtcGetTick(CpuContext ctx)
+    {
+        var dateTimeAddress = ctx[CpuRegister.Rdi];
+        var tickAddress = ctx[CpuRegister.Rsi];
+        if (dateTimeAddress == 0 || tickAddress == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        if (!TryReadRtcDateTime(ctx, dateTimeAddress, out var rtcDateTime))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        ulong tickValue;
+        try
+        {
+            var baseDateTime = new DateTime(
+                rtcDateTime.Year,
+                rtcDateTime.Month,
+                rtcDateTime.Day,
+                rtcDateTime.Hour,
+                rtcDateTime.Minute,
+                rtcDateTime.Second,
+                DateTimeKind.Utc);
+            tickValue = checked((ulong)((baseDateTime.Ticks / 10) + rtcDateTime.Microsecond));
+        }
+        catch (ArgumentOutOfRangeException)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        if (!ctx.TryWriteUInt64(tickAddress, tickValue))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    private static bool TryReadRtcDateTime(CpuContext ctx, ulong address, out RtcDateTime rtcDateTime)
+    {
+        Span<byte> buffer = stackalloc byte[16];
+        if (!ctx.Memory.TryRead(address, buffer))
+        {
+            rtcDateTime = default;
+            return false;
+        }
+
+        rtcDateTime = new RtcDateTime(
+            BinaryPrimitives.ReadUInt16LittleEndian(buffer[0..2]),
+            BinaryPrimitives.ReadUInt16LittleEndian(buffer[2..4]),
+            BinaryPrimitives.ReadUInt16LittleEndian(buffer[4..6]),
+            BinaryPrimitives.ReadUInt16LittleEndian(buffer[6..8]),
+            BinaryPrimitives.ReadUInt16LittleEndian(buffer[8..10]),
+            BinaryPrimitives.ReadUInt16LittleEndian(buffer[10..12]),
+            BinaryPrimitives.ReadUInt32LittleEndian(buffer[12..16]));
+        return true;
+    }
+
+    private readonly record struct RtcDateTime(
+        ushort Year,
+        ushort Month,
+        ushort Day,
+        ushort Hour,
+        ushort Minute,
+        ushort Second,
+        uint Microsecond);
+}
@@ -0,0 +1,112 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Text;
+using System.Threading;
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.Share;
+
+public static class ShareExports
+{
+    private const int MaxContentParamBytes = 4096;
+
+    private static int _initialized;
+    private static string _contentParam = string.Empty;
+
+    [SysAbiExport(
+        Nid = "nBDD66kiFW8",
+        ExportName = "sceShareInitialize",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceShareUtility")]
+    public static int ShareInitialize(CpuContext ctx)
+    {
+        var memorySize = ctx[CpuRegister.Rdi];
+        var priority = unchecked((int)ctx[CpuRegister.Rsi]);
+        var affinityMask = ctx[CpuRegister.Rdx];
+        if (memorySize == 0)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        Interlocked.Exchange(ref _initialized, 1);
+
+        TraceShare($"initialize memory=0x{memorySize:X} priority={priority} affinity=0x{affinityMask:X}");
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    [SysAbiExport(
+        Nid = "7QZtURYnXG4",
+        ExportName = "sceShareSetContentParam",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceShareUtility")]
+    public static int ShareSetContentParam(CpuContext ctx)
+    {
+        var contentParamAddress = ctx[CpuRegister.Rdi];
+        if (contentParamAddress == 0)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        if (!TryReadNullTerminatedUtf8(ctx, contentParamAddress, MaxContentParamBytes, out var contentParam))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        _contentParam = contentParam;
+        if (Volatile.Read(ref _initialized) == 0)
+        {
+            TraceShare("set_content_param before initialize");
+        }
+
+        TraceShare($"set_content_param len={contentParam.Length} preview='{FormatTraceString(contentParam)}'");
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    private static int SetReturn(CpuContext ctx, OrbisGen2Result result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)(int)result);
+        return (int)result;
+    }
+
+    private static bool TryReadNullTerminatedUtf8(CpuContext ctx, ulong address, int maxLength, out string value)
+    {
+        Span<byte> bytes = stackalloc byte[maxLength];
+        Span<byte> one = stackalloc byte[1];
+        for (var index = 0; index < maxLength; index++)
+        {
+            if (!ctx.Memory.TryRead(address + (ulong)index, one))
+            {
+                value = string.Empty;
+                return false;
+            }
+
+            if (one[0] == 0)
+            {
+                value = Encoding.UTF8.GetString(bytes[..index]);
+                return true;
+            }
+
+            bytes[index] = one[0];
+        }
+
+        value = string.Empty;
+        return false;
+    }
+
+    private static string FormatTraceString(string value)
+    {
+        var normalized = value.Replace("\r", "\\r", StringComparison.Ordinal).Replace("\n", "\\n", StringComparison.Ordinal);
+        return normalized.Length <= 120 ? normalized : string.Concat(normalized.AsSpan(0, 120), "...");
+    }
+
+    private static void TraceShare(string message)
+    {
+        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_SHARE"), "1", StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine($"[LOADER][TRACE] share.{message}");
+    }
+}
@@ -8,6 +8,12 @@ SPDX-License-Identifier: GPL-2.0-or-later
    <ProjectReference Include="..\SharpEmu.HLE\SharpEmu.HLE.csproj" />
  </ItemGroup>

+  <ItemGroup>
+    <PackageReference Include="Silk.NET.Vulkan" />
+    <PackageReference Include="Silk.NET.Vulkan.Extensions.KHR" />
+    <PackageReference Include="Silk.NET.Windowing" />
+  </ItemGroup>
+
  <PropertyGroup>
    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
  </PropertyGroup>
@@ -0,0 +1,65 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+using System.Buffers.Binary;
+
+namespace SharpEmu.Libs.SystemService;
+
+public static class SystemServiceExports
+{
+    private const int OrbisSystemServiceErrorParameter = unchecked((int)0x80A10003);
+    private const int SystemServiceStatusSize = 0x0C;
+    private const int DisplaySafeAreaInfoSize = sizeof(float) + 128;
+
+    [SysAbiExport(
+        Nid = "rPo6tV8D9bM",
+        ExportName = "sceSystemServiceGetStatus",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceSystemService")]
+    public static int SystemServiceGetStatus(CpuContext ctx)
+    {
+        var statusAddress = ctx[CpuRegister.Rdi];
+        if (statusAddress == 0)
+        {
+            return SetReturn(ctx, OrbisSystemServiceErrorParameter);
+        }
+
+        Span<byte> status = stackalloc byte[SystemServiceStatusSize];
+        status.Clear();
+        BinaryPrimitives.WriteInt32LittleEndian(status, 0);
+        status[0x06] = 1;
+
+        return ctx.Memory.TryWrite(statusAddress, status)
+            ? SetReturn(ctx, 0)
+            : SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+    }
+
+    [SysAbiExport(
+        Nid = "1n37q1Bvc5Y",
+        ExportName = "sceSystemServiceGetDisplaySafeAreaInfo",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceSystemService")]
+    public static int SystemServiceGetDisplaySafeAreaInfo(CpuContext ctx)
+    {
+        var infoAddress = ctx[CpuRegister.Rdi];
+        if (infoAddress == 0)
+        {
+            return SetReturn(ctx, OrbisSystemServiceErrorParameter);
+        }
+
+        Span<byte> info = stackalloc byte[DisplaySafeAreaInfoSize];
+        info.Clear();
+        BinaryPrimitives.WriteSingleLittleEndian(info, 1.0f);
+
+        return ctx.Memory.TryWrite(infoAddress, info)
+            ? SetReturn(ctx, 0)
+            : SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+    }
+
+    private static int SetReturn(CpuContext ctx, int result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)result);
+        return result;
+    }
+}
@@ -0,0 +1,79 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+using System.Buffers.Binary;
+
+namespace SharpEmu.Libs.UserService;
+
+public static class UserServiceExports
+{
+    private const int OrbisUserServiceErrorInvalidArgument = unchecked((int)0x80960005);
+    private const int PrimaryUserId = 1;
+    private const int InvalidUserId = -1;
+
+    [SysAbiExport(
+        Nid = "j3YMu1MVNNo",
+        ExportName = "sceUserServiceInitialize",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceUserService")]
+    public static int UserServiceInitialize(CpuContext ctx)
+    {
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "CdWp0oHWGr0",
+        ExportName = "sceUserServiceGetInitialUser",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceUserService")]
+    public static int UserServiceGetInitialUser(CpuContext ctx)
+    {
+        var userIdAddress = ctx[CpuRegister.Rdi];
+        if (userIdAddress == 0)
+        {
+            return SetReturn(ctx, OrbisUserServiceErrorInvalidArgument);
+        }
+
+        return TryWriteInt32(ctx, userIdAddress, PrimaryUserId)
+            ? SetReturn(ctx, 0)
+            : SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+    }
+
+    [SysAbiExport(
+        Nid = "fPhymKNvK-A",
+        ExportName = "sceUserServiceGetLoginUserIdList",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceUserService")]
+    public static int UserServiceGetLoginUserIdList(CpuContext ctx)
+    {
+        var userIdListAddress = ctx[CpuRegister.Rdi];
+        if (userIdListAddress == 0)
+        {
+            return SetReturn(ctx, OrbisUserServiceErrorInvalidArgument);
+        }
+
+        Span<byte> userIds = stackalloc byte[sizeof(int) * 4];
+        BinaryPrimitives.WriteInt32LittleEndian(userIds[0x00..], PrimaryUserId);
+        BinaryPrimitives.WriteInt32LittleEndian(userIds[0x04..], InvalidUserId);
+        BinaryPrimitives.WriteInt32LittleEndian(userIds[0x08..], InvalidUserId);
+        BinaryPrimitives.WriteInt32LittleEndian(userIds[0x0C..], InvalidUserId);
+        return ctx.Memory.TryWrite(userIdListAddress, userIds)
+            ? SetReturn(ctx, 0)
+            : SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+    }
+
+    private static bool TryWriteInt32(CpuContext ctx, ulong address, int value)
+    {
+        Span<byte> bytes = stackalloc byte[sizeof(int)];
+        BinaryPrimitives.WriteInt32LittleEndian(bytes, value);
+        return ctx.Memory.TryWrite(address, bytes);
+    }
+
+    private static int SetReturn(CpuContext ctx, int result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)result);
+        return result;
+    }
+}
@@ -2,6 +2,91 @@
  "version": 2,
  "dependencies": {
    "net10.0": {
+      "Silk.NET.Vulkan": {
+        "type": "Direct",
+        "requested": "[2.23.0, )",
+        "resolved": "2.23.0",
+        "contentHash": "3/irtlSWXZ3eTi8N6nelI6L34NTB8ZJHpqVMNzZx2aX7Ek9YEQ34NoQW8/Tljrtmkg8KRhHW8hKTEzZaKV8PgA==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0"
+        }
+      },
+      "Silk.NET.Vulkan.Extensions.KHR": {
+        "type": "Direct",
+        "requested": "[2.23.0, )",
+        "resolved": "2.23.0",
+        "contentHash": "uRaf4j+SmH3DumjSSSUbFg33BnsGZUyXGj93O9NgGKZSJN3OTmNmQDxRew+/KiVLcgH6qzbto8aNGZ++j9GFWg==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0",
+          "Silk.NET.Vulkan": "2.23.0"
+        }
+      },
+      "Silk.NET.Windowing": {
+        "type": "Direct",
+        "requested": "[2.23.0, )",
+        "resolved": "2.23.0",
+        "contentHash": "OPNPmt/lRyUKVYrFLQXVxyATqD3MKLc1iY1oKx1/2GppgmZxVZPwN12tekrQ4C7408kgB1L5JD1Wnirqqeb2kg==",
+        "dependencies": {
+          "Silk.NET.Windowing.Common": "2.23.0",
+          "Silk.NET.Windowing.Glfw": "2.23.0"
+        }
+      },
+      "Microsoft.DotNet.PlatformAbstractions": {
+        "type": "Transitive",
+        "resolved": "3.1.6",
+        "contentHash": "jek4XYaQ/PGUwDKKhwR8K47Uh1189PFzMeLqO83mXrXQVIpARZCcfuDedH50YDTepBkfijCZN5U/vZi++erxtg=="
+      },
+      "Microsoft.Extensions.DependencyModel": {
+        "type": "Transitive",
+        "resolved": "9.0.9",
+        "contentHash": "fNGvKct2De8ghm0Bpfq0iWthtzIWabgOTi+gJhNOPhNJIowXNEUE2eZNW/zNCzrHVA3PXg2yZ+3cWZndC2IqYA=="
+      },
+      "Silk.NET.Core": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "D7AT/nnwlB+4RZ84XY8QNGBZMJI5z9l4CSSETIJ1wCfRJzRt/341y3MRZ4HbnFz4r/IGaWOEZr86iE+0/65yyQ==",
+        "dependencies": {
+          "Microsoft.DotNet.PlatformAbstractions": "3.1.6",
+          "Microsoft.Extensions.DependencyModel": "9.0.9"
+        }
+      },
+      "Silk.NET.GLFW": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "UIs4sH57xlPUNHQ/1bt9rymPWlGy8IMDCNv86h0iM4TOA1CkIx0XM/n/tA4AReh1zQkNrvkxPEdZ3Blvy1dyXg==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0",
+          "Ultz.Native.GLFW": "3.4.0"
+        }
+      },
+      "Silk.NET.Maths": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "r8PdIVzME8EH0qAgbmRPO87I4GfgR2j8TofT7EMuRJDf1QluoQwnVypDoFJjQ2ZBSRsGYk5unYxxogI05Ogsmw=="
+      },
+      "Silk.NET.Windowing.Common": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "ThStSinmY9KQI8DGiF5XEhkLJVnBcgRTBTzL9ijg1wMZAYuckz7ykrNw04fjRm2Gryh6tCNGbvz2XaY0efeFzg==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0",
+          "Silk.NET.Maths": "2.23.0"
+        }
+      },
+      "Silk.NET.Windowing.Glfw": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "aYBudKmENmvLRn9p15HbdvlQTnnXskcDfTfbYwSb/4fr263rGLwYuDw/txUEc2jihHJiWCp5+75Y7z5wTJWl7g==",
+        "dependencies": {
+          "Silk.NET.GLFW": "2.23.0",
+          "Silk.NET.Windowing.Common": "2.23.0"
+        }
+      },
+      "Ultz.Native.GLFW": {
+        "type": "Transitive",
+        "resolved": "3.4.0",
+        "contentHash": "Iy22JopynbOJ32vA0lBhFEzGi65GQJBuJHYBYRBpydrDpNoTiHnjIXfA65Gu+8qsOr/ZEoIF8r9aHCgAXuO6DA=="
+      },
      "sharpemu.hle": {
        "type": "Project"
      }
Author	SHA1	Message	Date
ParantezTech	4ab614e68a	[npManager] initial Network Platform implement (just set game title etc.)	2026-06-23 19:30:27 +03:00
ParantezTech	e581fe41f4	[kernel] pthread improvements	2026-06-23 19:29:29 +03:00
ParantezTech	0f0ec9a020	[appContent] correct way to get metadata from game	2026-06-23 19:28:53 +03:00
ParantezTech	70048cb49f	[agc] fix shader invalid argument	2026-06-23 19:27:57 +03:00
ParantezTech	4777ec4544	[sceShare] initial share exports	2026-06-23 19:27:24 +03:00
ParantezTech	caee2ad692	[readme] alignment	2026-06-23 17:54:39 +03:00
ParantezTech	7c83f7f925	[readme] logo align	2026-06-23 17:52:45 +03:00
ParantezTech	0e37bc95e9	upload logo	2026-06-23 17:51:28 +03:00
ParantezTech	318425630a	[readme] edit for new milestones	2026-06-23 16:06:58 +03:00
ParantezTech	992ef68ba8	[readme] update	2026-06-23 16:05:16 +03:00
ParantezTech	01ebab90c0	[playgo] In some games, chunk scenarios assertion rewrite	2026-06-23 15:50:43 +03:00
ParantezTech	d134f9b9f6	[fiber] synchronization problems have been fixed for such a titles: Demon's Souls [ampr] new exports [memory] trampoline fixes	2026-06-23 15:48:45 +03:00
ParantezTech	dad85b87c3	[video] Add game title to window	2026-06-21 23:19:16 +03:00
ParantezTech	464422f23e	[video] Add Vulkan presentation	2026-06-21 23:19:05 +03:00
ParantezTech	5afa5e1ffa	[hle] Add missing service exports	2026-06-21 23:18:55 +03:00
ParantezTech	5512da9e12	[kernel] Add thread and event primitives	2026-06-21 23:18:42 +03:00
ParantezTech	2a52ccfe6a	[cpu] Add guest thread continuation	2026-06-21 23:18:29 +03:00
ParantezTech	08b315b5fc	[kernel] Add guest memory support	2026-06-21 23:18:18 +03:00
ParantezTech	5d204afd10	[videoOut] add minimal Vulkan swapchain presenter	2026-06-14 12:12:09 +03:00
ParantezTech	7bd1e8dc29	change jpg to sharpemu videoOut test window	2026-06-07 16:15:43 +03:00
ParantezTech	fad61e116e	reuse	2026-06-07 15:56:07 +03:00
ParantezTech	bc297fa175	[readme] update jpg	2026-06-07 15:48:11 +03:00
ParantezTech	79e767ed9f	[readme] added rendering texture from Dreaming Sarah (this is just a presenter draw, not GPU swapchain)	2026-06-07 15:45:33 +03:00
ParantezTech	1ea1396979	[kernel/videoOut] extend memory managements and videoOut (this is not a swapchain)	2026-06-07 15:43:26 +03:00
ParantezTech	a1dea499bc	update readme	2026-05-10 20:37:49 +03:00
ParantezTech	fee6af3136	update readme for new titles	2026-05-10 20:02:58 +03:00
ParantezTech	bbf5ff7be8	more HLE's and fix cpu execution some titles	2026-05-10 19:51:57 +03:00
ParantezTech	0c859f04ad	Added more HLE's	2026-04-27 12:40:50 +03:00
ParantezTech	994438963d	[ci] temporary fix	2026-04-13 15:59:19 +03:00
ParantezTech	233af123af	More new HLE's and fixes	2026-04-13 15:54:38 +03:00
ParantezTech	02eb9b30e9	correct patch	2026-03-28 18:40:54 +03:00
ParantezTech	fa46819030	fix for actions (again)	2026-03-28 18:23:46 +03:00
ParantezTech	7a915e88dc	fix dotnet version on Github Actions	2026-03-28 18:15:14 +03:00
ParantezTech	812879aa81	PlayGo, VideoOut minimum HLE implements and fix some direct runner	2026-03-28 18:02:37 +03:00
ParantezTech	71ba5cf1db	More HLE implements: wcs*	2026-03-19 23:57:48 +03:00
ParantezTech	8f108ca01d	Upgrade GitHub Actions to Node 24	2026-03-19 13:33:19 +03:00
ParantezTech	cecf55bf2e	fix: dereference of a possibly null reference.	2026-03-16 21:19:49 +03:00
ParantezTech	0ede7c70a9	[ci] update actions Node 20 deprecation	2026-03-16 21:18:58 +03:00
ParantezTech	8c39a55501	reuse	2026-03-16 20:49:40 +03:00
ParantezTech	0a4b36ffcb	[dotnet/ci] constant version	2026-03-16 20:46:47 +03:00
ParantezTech	1a1d61b21c	rework TLS allocations, more HLE's, increase import loop history	2026-03-16 20:22:58 +03:00
ParantezTech	3cf96f38de	[github] bug_report fix	2026-03-16 20:14:58 +03:00
ParantezTech	d8c44bb64f	[github] added bug report issue template	2026-03-16 20:11:56 +03:00
ParantezTech	a4b5171586	[github] added issue config & reuse	2026-03-16 20:01:08 +03:00
ParantezTech	1f71c970d9	A dozen changes; new HLEs, AV fixes, ELF loader fixes, new return codes, etc.	2026-03-14 20:38:25 +03:00
ParantezTech	028494a83b	another hle implements, especially for mutex calls	2026-03-12 18:01:42 +03:00
ParantezTech	73ae502e09	update readme	2026-03-12 16:32:32 +03:00
ParantezTech	51d204775e	[github] update compatibility template	2026-03-12 16:17:54 +03:00
ParantezTech	7ce6b9e2af	[github] added compatibility template	2026-03-12 16:06:29 +03:00
ParantezTech	d4cd4eb96f	update readme	2026-03-11 17:03:34 +03:00