Add files via upload (#202)

Added Hungarian tranlation. -Pacuka

.github/workflows/workflow.yml

@@ -100,6 +100,9 @@ jobs:
       - name: Build solution
         run: dotnet build SharpEmu.slnx -c Release --no-restore
 
+      - name: Validate synthetic shaders
+        run: dotnet run --project tools/SharpEmu.Tools.ShaderDump/SharpEmu.Tools.ShaderDump.csproj -c Release -- artifacts/shader-dump
+
       - name: Publish win-x64 CLI
         run: dotnet publish src/SharpEmu.CLI/SharpEmu.CLI.csproj -c Release -r win-x64 --self-contained true --no-restore -p:PublishDir="${env:PUBLISH_DIR}"
 

Directory.Packages.props

@@ -12,11 +12,14 @@ SPDX-License-Identifier: GPL-2.0-or-later
     <PackageVersion Include="Avalonia.Fonts.Inter" Version="11.3.18" />
     <PackageVersion Include="Avalonia.Themes.Fluent" Version="11.3.18" />
     <PackageVersion Include="Iced" Version="1.21.0" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
     <PackageVersion Include="Silk.NET.Vulkan" Version="2.23.0" />
     <PackageVersion Include="Silk.NET.Vulkan.Extensions.EXT" Version="2.23.0" />
     <PackageVersion Include="Silk.NET.Vulkan.Extensions.KHR" Version="2.23.0" />
     <PackageVersion Include="Silk.NET.Windowing" Version="2.23.0" />
     <!-- Transitive of Avalonia.Desktop; pinned to fix GHSA-xrw6-gwf8-vvr9 -->
     <PackageVersion Include="Tmds.DBus.Protocol" Version="0.21.3" />
+    <PackageVersion Include="xunit" Version="2.9.3" />
+    <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.1" />
   </ItemGroup>
 </Project>

SharpEmu.slnx

@@ -12,4 +12,7 @@ SPDX-License-Identifier: GPL-2.0-or-later
     <Project Path="src/SharpEmu.Libs/SharpEmu.Libs.csproj" />
     <Project Path="src/SharpEmu.Logging/SharpEmu.Logging.csproj" />
   </Folder>
+  <Folder Name="/tests/">
+    <Project Path="tests/SharpEmu.Libs.Tests/SharpEmu.Libs.Tests.csproj" />
+  </Folder>
 </Solution>

scripts/check_sysabi_aerolib.py

@@ -0,0 +1,172 @@
+# Copyright (C) 2026 SharpEmu Emulator Project
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+#!/usr/bin/env python3
+
+"""Offline check: SysAbiExport ExportName must hash to its Nid (name2nid).
+
+NIDs absent from aerolib.bin are skipped (unknown/unresolved symbols).
+Known historic mislabels may be allowlisted with a one-line reason.
+
+Run from the repository root:
+  python scripts/check_sysabi_aerolib.py
+  python scripts/check_sysabi_aerolib.py --strict
+"""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import re
+import struct
+import sys
+from base64 import b64encode as base64enc
+from binascii import unhexlify as uhx
+from pathlib import Path
+
+SRC_ROOT = Path("src")
+AEROLIB_BIN = Path("src/SharpEmu.HLE/Aerolib/aerolib.bin")
+SYSABI_EXPORT_RE = re.compile(r"\[SysAbiExport\((.*?)\)\]", re.DOTALL)
+NID_RE = re.compile(r'Nid\s*=\s*"([^"]+)"')
+EXPORT_NAME_RE = re.compile(r'ExportName\s*=\s*"([^"]+)"')
+
+# NID -> reason. Keep minimal; fix ExportName when safe instead of growing this list.
+ALLOWLISTED_NIDS: dict[str, str] = {
+    "KMcEa+rHsIo": "Historic kernel MapMemory stub bound to sceAvPlayerAddSource NID; API rewrite deferred.",
+    "WV1GwM32NgY": "Historic WebApi2 init alias for PushEventCreateHandle NID; ABI rewrite deferred.",
+}
+
+
+def name2nid(name: str) -> str:
+    symbol = hashlib.sha1(name.encode() + uhx("518D64A635DED8C1E6B039B1C3E55230")).digest()
+    id_val = struct.unpack("<Q", symbol[:8])[0]
+    nid = base64enc(uhx("%016x" % id_val), b"+-").rstrip(b"=")
+    return nid.decode("utf-8")
+
+
+def find_repo_root() -> Path:
+    cwd = Path.cwd()
+    if (cwd / SRC_ROOT).is_dir() and (cwd / "scripts").is_dir():
+        return cwd
+    script_root = Path(__file__).resolve().parent.parent
+    if (script_root / SRC_ROOT).is_dir():
+        return script_root
+    raise SystemExit("Run from the repository root (src/ and scripts/ expected).")
+
+
+def load_aerolib_nids(aerolib_path: Path) -> set[str]:
+    data = aerolib_path.read_bytes()
+    if len(data) < 4:
+        raise SystemExit(f"Aerolib binary too small: {aerolib_path}")
+
+    count = struct.unpack_from("<I", data, 0)[0]
+    offset = 4
+    nids: set[str] = set()
+    for _ in range(count):
+        if offset >= len(data):
+            raise SystemExit(f"Truncated aerolib.bin while reading NIDs: {aerolib_path}")
+        nid_len = data[offset]
+        offset += 1
+        nid = data[offset : offset + nid_len].decode("utf-8")
+        offset += nid_len
+        if offset + 2 > len(data):
+            raise SystemExit(f"Truncated aerolib.bin name length: {aerolib_path}")
+        name_len = struct.unpack_from("<H", data, offset)[0]
+        offset += 2 + name_len
+        nids.add(nid)
+    return nids
+
+
+def iter_sysabi_exports(cs_path: Path, text: str):
+    for match in SYSABI_EXPORT_RE.finditer(text):
+        block = match.group(1)
+        nid_match = NID_RE.search(block)
+        export_match = EXPORT_NAME_RE.search(block)
+        if nid_match is None or export_match is None:
+            continue
+
+        nid = nid_match.group(1)
+        export_name = export_match.group(1)
+        nid_attr = f'Nid = "{nid}"'
+        abs_pos = text.find(nid_attr, match.start(), match.end())
+        if abs_pos < 0:
+            abs_pos = match.start()
+        line = text.count("\n", 0, abs_pos) + 1
+        yield cs_path, line, nid, export_name
+
+
+def scan(src_root: Path, catalog_nids: set[str]):
+    checked = 0
+    mismatches = []
+    skipped_no_catalog = 0
+    allowlisted = 0
+
+    for cs_path in sorted(src_root.rglob("*.cs")):
+        text = cs_path.read_text(encoding="utf-8")
+        for path, line, nid, export_name in iter_sysabi_exports(cs_path, text):
+            checked += 1
+            computed = name2nid(export_name)
+            if computed == nid:
+                continue
+
+            if nid not in catalog_nids:
+                skipped_no_catalog += 1
+                continue
+
+            if nid in ALLOWLISTED_NIDS:
+                allowlisted += 1
+                continue
+
+            mismatches.append((path, line, nid, export_name, computed))
+
+    return checked, mismatches, skipped_no_catalog, allowlisted
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(
+        description="Check that SysAbiExport ExportName values hash to their Nid via name2nid."
+    )
+    parser.add_argument(
+        "--strict",
+        action="store_true",
+        help="Exit 1 when any non-skipped/non-allowlisted ExportName does not hash to its Nid.",
+    )
+    parser.add_argument(
+        "--quiet",
+        action="store_true",
+        help="Print only the summary line.",
+    )
+    args = parser.parse_args()
+
+    repo_root = find_repo_root()
+    aerolib_path = repo_root / AEROLIB_BIN
+    if not aerolib_path.is_file():
+        raise SystemExit(f"Missing Aerolib catalog: {aerolib_path.as_posix()}")
+
+    catalog_nids = load_aerolib_nids(aerolib_path)
+    checked, mismatches, skipped_no_catalog, allowlisted = scan(
+        repo_root / SRC_ROOT, catalog_nids
+    )
+    ok = checked - len(mismatches) - skipped_no_catalog - allowlisted
+
+    if not args.quiet:
+        for path, line, nid, export_name, computed in mismatches:
+            rel = path.relative_to(repo_root).as_posix()
+            print(
+                f"{rel}:{line}: NID={nid} ExportName={export_name!r} "
+                f"computed={computed}"
+            )
+
+    print(
+        f"checked={checked} ok={ok} fail={len(mismatches)} "
+        f"skipped_no_catalog={skipped_no_catalog} allowlisted={allowlisted} "
+        f"allowlist_size={len(ALLOWLISTED_NIDS)}"
+    )
+
+    if args.strict and mismatches:
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/ps5_names.txt

@@ -154449,3 +154449,9 @@ vector_str_substr
 WTFAnnotateBenignRaceSized
 WTFAnnotateHappensAfter
 WTFAnnotateHappensBefore
+_sceUlobjmgrRegisterObject
+_sceUlobjmgrUnregisterObject
+sceNpEAAccessInitialize
+sceNpEAAccessTerminate
+sceNpHasEAAccessSubscription
+sceNpHasEAAccessSubscriptionAbortRequest

src/SharpEmu.CLI/Program.cs

@@ -5,6 +5,7 @@ using SharpEmu.Core.Runtime;
 using SharpEmu.Core.Cpu;
 using SharpEmu.GUI;
 using SharpEmu.HLE;
+using SharpEmu.Libs.VideoOut;
 using SharpEmu.Logging;
 using System.Runtime.InteropServices;
 using System.Text;
@@ -111,8 +112,16 @@ internal static partial class Program
         using var runtime = SharpEmuRuntime.CreateDefault(runtimeOptions);
 
         OrbisGen2Result result;
+        ConsoleCancelEventHandler? cancelHandler = null;
         try
         {
+            cancelHandler = (_, eventArgs) =>
+            {
+                eventArgs.Cancel = true;
+                VideoOutExports.NotifyHostInterrupt();
+            };
+            Console.CancelKeyPress += cancelHandler;
+
             Console.Error.WriteLine($"[DEBUG] Running: {ebootPath}");
             result = runtime.Run(ebootPath);
             Console.Error.WriteLine($"[DEBUG] Result: {result}");
@@ -123,6 +132,13 @@ internal static partial class Program
             Log.Error("SharpEmu failed to run.", ex);
             return 3;
         }
+        finally
+        {
+            if (cancelHandler is not null)
+            {
+                Console.CancelKeyPress -= cancelHandler;
+            }
+        }
 
         Log.Info($"SharpEmu execution completed. Result={result} (0x{(int)result:X8})");
         if (!string.IsNullOrWhiteSpace(runtime.LastSessionSummary))

src/SharpEmu.Core/Cpu/CpuDispatcher.cs

@@ -7,6 +7,7 @@ using SharpEmu.Core.Cpu.Native;
 using SharpEmu.Core.Loader;
 using SharpEmu.Core.Memory;
 using SharpEmu.HLE;
+using SharpEmu.HLE.Host;
 using SharpEmu.Logging;
 
 namespace SharpEmu.Core.Cpu;
@@ -41,16 +42,19 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
     ];
     private readonly IVirtualMemory _virtualMemory;
     private readonly IModuleManager _moduleManager;
+    private readonly IHostPlatform? _hostPlatform;
     private INativeCpuBackend? _nativeCpuBackend;
 
     public CpuDispatcher(
         IVirtualMemory virtualMemory,
         IModuleManager moduleManager,
-        INativeCpuBackend? nativeCpuBackend = null)
+        INativeCpuBackend? nativeCpuBackend = null,
+        IHostPlatform? hostPlatform = null)
     {
         _virtualMemory = virtualMemory ?? throw new ArgumentNullException(nameof(virtualMemory));
         _moduleManager = moduleManager ?? throw new ArgumentNullException(nameof(moduleManager));
         _nativeCpuBackend = nativeCpuBackend;
+        _hostPlatform = hostPlatform;
     }
 
     public ulong? LastEntryPoint { get; private set; }
@@ -266,7 +270,7 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
             entryFrameDiagnostic,
             Environment.NewLine,
             "CpuEngine: native-only");
-        _nativeCpuBackend ??= new DirectExecutionBackend(_moduleManager);
+        _nativeCpuBackend ??= new DirectExecutionBackend(_moduleManager, _hostPlatform);
         if (_nativeCpuBackend.TryExecute(
                 context,
                 entryPoint,

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.Diagnostics.cs

@@ -8,6 +8,7 @@ using System.Linq;
 using System.Runtime.InteropServices;
 using System.Threading;
 using SharpEmu.HLE;
+using SharpEmu.HLE.Host;
 using SharpEmu.Logging;
 
 namespace SharpEmu.Core.Cpu.Native;
@@ -134,8 +135,9 @@ public sealed partial class DirectExecutionBackend
 		int num2 = 0;
 		List<ulong> list = new List<ulong>(16);
 		ulong num3 = scanStart;
-		MEMORY_BASIC_INFORMATION64 lpBuffer;
-		while (num3 < scanEnd && VirtualQuery((void*)num3, out lpBuffer, (nuint)sizeof(MEMORY_BASIC_INFORMATION64)) != 0)
+		var hostMemory = ResolveDiagnosticsHostMemory();
+		HostRegionInfo lpBuffer;
+		while (num3 < scanEnd && hostMemory.Query(num3, out lpBuffer))
 		{
 			ulong baseAddress = lpBuffer.BaseAddress;
 			ulong num4 = baseAddress + lpBuffer.RegionSize;
@@ -145,7 +147,7 @@ public sealed partial class DirectExecutionBackend
 			}
 			ulong value = Math.Max(num3, baseAddress);
 			ulong num5 = Math.Min(num4, scanEnd);
-			if (lpBuffer.State == 4096 && IsReadableProtection(lpBuffer.Protect) && !IsExecutableProtection(lpBuffer.Protect))
+			if (lpBuffer.State == HostRegionState.Committed && IsReadableProtection(lpBuffer.RawProtection) && !IsExecutableProtection(lpBuffer.RawProtection))
 			{
 				ulong num6 = AlignUp(value, 8uL);
 				for (ulong num7 = num6; num7 + 8 <= num5; num7 += 8)
@@ -350,7 +352,7 @@ public sealed partial class DirectExecutionBackend
 		{
 			return false;
 		}
-		if (VirtualQuery((void*)address, out var lpBuffer, (nuint)sizeof(MEMORY_BASIC_INFORMATION64)) == 0)
+		if (!ResolveDiagnosticsHostMemory().Query(address, out var lpBuffer))
 		{
 			return false;
 		}
@@ -359,7 +361,7 @@ public sealed partial class DirectExecutionBackend
 		{
 			return false;
 		}
-		if (lpBuffer.State != 4096 || !IsReadableProtection(lpBuffer.Protect))
+		if (lpBuffer.State != HostRegionState.Committed || !IsReadableProtection(lpBuffer.RawProtection))
 		{
 			return false;
 		}
@@ -391,12 +393,12 @@ public sealed partial class DirectExecutionBackend
 			return true;
 		}
 
-		if (VirtualQuery((void*)address, out var lpBuffer, (nuint)sizeof(MEMORY_BASIC_INFORMATION64)) == 0)
+		if (!ResolveDiagnosticsHostMemory().Query(address, out var lpBuffer))
 		{
 			return false;
 		}
 
-		var executable = lpBuffer.State == 4096 && IsExecutableProtection(lpBuffer.Protect);
+		var executable = lpBuffer.State == HostRegionState.Committed && IsExecutableProtection(lpBuffer.RawProtection);
 		if (executable)
 		{
 			_knownExecutablePages.TryAdd(pageAddress, 0);
@@ -415,6 +417,14 @@ public sealed partial class DirectExecutionBackend
 		return (value + num) & ~num;
 	}
 
+	// Diagnostics helpers are static (reachable from static handler paths), so
+	// they use the platform injected into the backend active on this thread and
+	// fall back to the process-wide singleton only when no run is bound.
+	private static IHostMemory ResolveDiagnosticsHostMemory()
+	{
+		return _activeExecutionBackend?._hostMemory ?? HostPlatform.Current.Memory;
+	}
+
 	private static bool IsReadableProtection(uint protect)
 	{
 		if ((protect & 0x100) != 0 || (protect & 1) != 0)

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.Exceptions.cs

@@ -9,7 +9,9 @@ using System.Reflection;
 using System.Runtime.InteropServices;
 using System.Threading;
 using SharpEmu.Core.Cpu.Disasm;
+using SharpEmu.Core.Cpu.Native.Windows;
 using SharpEmu.HLE;
+using SharpEmu.HLE.Host;
 
 namespace SharpEmu.Core.Cpu.Native;
 
@@ -22,12 +24,12 @@ public sealed partial class DirectExecutionBackend
 	{
 		if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_DISABLE_RAW_HANDLER"), "1", StringComparison.Ordinal))
 		{
-			_rawExceptionHandlerStub = CreateExceptionHandlerTrampoline(RawVectoredHandlerPtrManaged);
+			_rawExceptionHandlerStub = _faultHandling.CreateHandlerThunk(RawVectoredHandlerPtrManaged, _hostRspSlotTlsIndex, _tlsGetValueAddress);
 			if (_rawExceptionHandlerStub == 0)
 			{
 				throw new InvalidOperationException("Failed to create raw exception handler trampoline");
 			}
-			_rawExceptionHandler = (nint)AddVectoredExceptionHandler(1u, _rawExceptionHandlerStub);
+			_rawExceptionHandler = _faultHandling.AddFirstChanceHandler(_rawExceptionHandlerStub);
 			Console.Error.WriteLine($"[LOADER][INFO] Raw exception handler installed: 0x{_rawExceptionHandler:X16}");
 		}
 		else
@@ -37,22 +39,22 @@ public sealed partial class DirectExecutionBackend
 
 		_handlerDelegate = VectoredHandler;
 		_handlerHandle = GCHandle.Alloc(_handlerDelegate);
-		_exceptionHandlerStub = CreateExceptionHandlerTrampoline(Marshal.GetFunctionPointerForDelegate(_handlerDelegate));
+		_exceptionHandlerStub = _faultHandling.CreateHandlerThunk(Marshal.GetFunctionPointerForDelegate(_handlerDelegate), _hostRspSlotTlsIndex, _tlsGetValueAddress);
 		if (_exceptionHandlerStub == 0)
 		{
 			throw new InvalidOperationException("Failed to create exception handler trampoline");
 		}
-		_exceptionHandler = (nint)AddVectoredExceptionHandler(1u, _exceptionHandlerStub);
+		_exceptionHandler = _faultHandling.AddFirstChanceHandler(_exceptionHandlerStub);
 		Console.Error.WriteLine($"[LOADER][INFO] Exception handler installed: 0x{_exceptionHandler:X16}");
 
 		_unhandledFilterDelegate = UnhandledExceptionFilter;
 		_unhandledFilterHandle = GCHandle.Alloc(_unhandledFilterDelegate);
-		_unhandledFilterStub = CreateExceptionHandlerTrampoline(Marshal.GetFunctionPointerForDelegate(_unhandledFilterDelegate));
+		_unhandledFilterStub = _faultHandling.CreateHandlerThunk(Marshal.GetFunctionPointerForDelegate(_unhandledFilterDelegate), _hostRspSlotTlsIndex, _tlsGetValueAddress);
 		if (_unhandledFilterStub == 0)
 		{
 			throw new InvalidOperationException("Failed to create unhandled exception filter trampoline");
 		}
-		SetUnhandledExceptionFilter(_unhandledFilterStub);
+		_faultHandling.SetUnhandledFilter(_unhandledFilterStub);
 	}
 
 	private unsafe int UnhandledExceptionFilter(void* exceptionInfo)
@@ -60,8 +62,8 @@ public sealed partial class DirectExecutionBackend
 		try
 		{
 			EXCEPTION_RECORD* exceptionRecord = ((EXCEPTION_POINTERS*)exceptionInfo)->ExceptionRecord;
-			ulong rip = ReadCtxU64(((EXCEPTION_POINTERS*)exceptionInfo)->ContextRecord, 248);
-			ulong rsp = ReadCtxU64(((EXCEPTION_POINTERS*)exceptionInfo)->ContextRecord, 152);
+			ulong rip = ReadCtxU64(((EXCEPTION_POINTERS*)exceptionInfo)->ContextRecord, CTX_RIP);
+			ulong rsp = ReadCtxU64(((EXCEPTION_POINTERS*)exceptionInfo)->ContextRecord, CTX_RSP);
 			Console.Error.WriteLine("[LOADER][FATAL] Unhandled exception filter fired.");
 			Console.Error.WriteLine($"[LOADER][FATAL]   Code: 0x{exceptionRecord->ExceptionCode:X8}");
 			Console.Error.WriteLine($"[LOADER][FATAL]   Exception Address: 0x{(ulong)(nint)exceptionRecord->ExceptionAddress:X16}");
@@ -100,8 +102,8 @@ public sealed partial class DirectExecutionBackend
 				return 0;
 			}
 
-			ulong rip = ReadCtxU64(contextRecord, 248);
-			ulong rsp = ReadCtxU64(contextRecord, 152);
+			ulong rip = ReadCtxU64(contextRecord, CTX_RIP);
+			ulong rsp = ReadCtxU64(contextRecord, CTX_RSP);
 
 			// Thread-mode probe: a hardware exception raised while this thread is inside
 			// the managed import gateway means the VEH->managed reentry happened from
@@ -112,7 +114,7 @@ public sealed partial class DirectExecutionBackend
 					$"veh_in_gateway code=0x{exceptionCode:X8} rip=0x{rip:X16} gateway_depth={_threadModeGatewayDepth}");
 			}
 
-			if (exceptionCode == 3221225477u && TryHandleLazyCommittedPage(exceptionRecord, rip, rsp))
+			if (exceptionCode == WindowsFaultCodes.AccessViolation && TryHandleLazyCommittedPage(exceptionRecord, rip, rsp))
 			{
 				return -1;
 			}
@@ -127,10 +129,10 @@ public sealed partial class DirectExecutionBackend
 
 			switch (exceptionCode)
 			{
-				case 3221225477u:
+				case WindowsFaultCodes.AccessViolation:
 					LogAccessViolationTrace(exceptionAddress, exceptionRecord);
 					break;
-				case 3221226505u:
+				case WindowsFaultCodes.FastFail:
 					{
 						ulong p0 = exceptionRecord->NumberParameters >= 1 ? (*exceptionRecord->ExceptionInformation) : 0;
 						ulong p1 = exceptionRecord->NumberParameters >= 2 ? exceptionRecord->ExceptionInformation[1] : 0;
@@ -140,21 +142,21 @@ public sealed partial class DirectExecutionBackend
 					}
 			}
 
-			ulong rax = ReadCtxU64(contextRecord, 120);
-			ulong rbx = ReadCtxU64(contextRecord, 144);
-			ulong rcx = ReadCtxU64(contextRecord, 128);
-			ulong rdx = ReadCtxU64(contextRecord, 136);
-			ulong rsi = ReadCtxU64(contextRecord, 168);
-			ulong rdi = ReadCtxU64(contextRecord, 176);
-			ulong rbp = ReadCtxU64(contextRecord, 160);
-			ulong r8 = ReadCtxU64(contextRecord, 184);
-			ulong r9 = ReadCtxU64(contextRecord, 192);
-			ulong r10 = ReadCtxU64(contextRecord, 200);
-			ulong r11 = ReadCtxU64(contextRecord, 208);
-			ulong r12 = ReadCtxU64(contextRecord, 216);
-			ulong r13 = ReadCtxU64(contextRecord, 224);
-			ulong r14 = ReadCtxU64(contextRecord, 232);
-			ulong r15 = ReadCtxU64(contextRecord, 240);
+			ulong rax = ReadCtxU64(contextRecord, CTX_RAX);
+			ulong rbx = ReadCtxU64(contextRecord, CTX_RBX);
+			ulong rcx = ReadCtxU64(contextRecord, CTX_RCX);
+			ulong rdx = ReadCtxU64(contextRecord, CTX_RDX);
+			ulong rsi = ReadCtxU64(contextRecord, CTX_RSI);
+			ulong rdi = ReadCtxU64(contextRecord, CTX_RDI);
+			ulong rbp = ReadCtxU64(contextRecord, CTX_RBP);
+			ulong r8 = ReadCtxU64(contextRecord, CTX_R8);
+			ulong r9 = ReadCtxU64(contextRecord, CTX_R9);
+			ulong r10 = ReadCtxU64(contextRecord, CTX_R10);
+			ulong r11 = ReadCtxU64(contextRecord, CTX_R11);
+			ulong r12 = ReadCtxU64(contextRecord, CTX_R12);
+			ulong r13 = ReadCtxU64(contextRecord, CTX_R13);
+			ulong r14 = ReadCtxU64(contextRecord, CTX_R14);
+			ulong r15 = ReadCtxU64(contextRecord, CTX_R15);
 
 			Console.Error.WriteLine("[LOADER][INFO] =========================================");
 			Console.Error.WriteLine("[LOADER][INFO] NATIVE EXCEPTION CAUGHT!");
@@ -185,7 +187,7 @@ public sealed partial class DirectExecutionBackend
 
 			ulong accessType = 0;
 			ulong target = 0;
-			if (exceptionCode == 3221225477u && exceptionRecord->NumberParameters >= 2)
+			if (exceptionCode == WindowsFaultCodes.AccessViolation && exceptionRecord->NumberParameters >= 2)
 			{
 				accessType = *exceptionRecord->ExceptionInformation;
 				target = exceptionRecord->ExceptionInformation[1];
@@ -198,9 +200,9 @@ public sealed partial class DirectExecutionBackend
 				};
 				Console.Error.WriteLine("[LOADER][INFO]   AV access: " + accessText);
 				Console.Error.WriteLine($"[LOADER][INFO]   AV target: 0x{target:X16}");
-				if (VirtualQuery((void*)target, out var mbi, (nuint)sizeof(MEMORY_BASIC_INFORMATION64)) != 0)
+				if (_hostMemory.Query(target, out var mbi))
 				{
-					Console.Error.WriteLine($"[LOADER][INFO]   AV target region: base=0x{mbi.BaseAddress:X16} size=0x{mbi.RegionSize:X16} state=0x{mbi.State:X08} protect=0x{mbi.Protect:X08}");
+					Console.Error.WriteLine($"[LOADER][INFO]   AV target region: base=0x{mbi.BaseAddress:X16} size=0x{mbi.RegionSize:X16} state=0x{mbi.RawState:X08} protect=0x{mbi.RawProtection:X08}");
 				}
 
 			}
@@ -248,7 +250,7 @@ public sealed partial class DirectExecutionBackend
 
 			switch (exceptionCode)
 			{
-				case 3221225477u:
+				case WindowsFaultCodes.AccessViolation:
 					Console.Error.WriteLine("[LOADER][ERROR]   Type: Access Violation");
 					Console.Error.WriteLine("[LOADER][ERROR]   This usually means:");
 					Console.Error.WriteLine("[LOADER][ERROR]     - Guest code called an unmapped import");
@@ -295,11 +297,11 @@ public sealed partial class DirectExecutionBackend
 					DumpGuestReferenceDiagnostics();
 					DumpGuestPointerWindowDiagnostics();
 					break;
-				case 2147483651u:
+				case WindowsFaultCodes.Breakpoint:
 					Console.Error.WriteLine("[LOADER][WARNING]   Type: Breakpoint (int3)");
 					Console.Error.WriteLine("[LOADER][WARNING]   Unexpected breakpoint in direct-bridge mode");
 					break;
-				case 3221225501u:
+				case WindowsFaultCodes.IllegalInstruction:
 					Console.Error.WriteLine("[LOADER][INFO]   Type: Illegal Instruction");
 					break;
 			}
@@ -332,8 +334,8 @@ public sealed partial class DirectExecutionBackend
 			EXCEPTION_POINTERS* pointers = (EXCEPTION_POINTERS*)exceptionInfo;
 			EXCEPTION_RECORD* record = pointers->ExceptionRecord;
 			void* contextRecord = pointers->ContextRecord;
-			ulong rip = contextRecord != null ? ReadCtxU64(contextRecord, 248) : 0;
-			ulong rsp = contextRecord != null ? ReadCtxU64(contextRecord, 152) : 0;
+			ulong rip = contextRecord != null ? ReadCtxU64(contextRecord, CTX_RIP) : 0;
+			ulong rsp = contextRecord != null ? ReadCtxU64(contextRecord, CTX_RSP) : 0;
 			ulong accessType = record->NumberParameters >= 1 ? *record->ExceptionInformation : 0;
 			ulong target = record->NumberParameters >= 2 ? record->ExceptionInformation[1] : 0;
 			Console.Error.WriteLine(
@@ -479,7 +481,7 @@ public sealed partial class DirectExecutionBackend
 		ulong address = scanBase;
 		while (address < scanEnd)
 		{
-			if (VirtualQuery((void*)address, out var mbi, (nuint)sizeof(MEMORY_BASIC_INFORMATION64)) == 0)
+			if (!_hostMemory.Query(address, out var mbi))
 			{
 				break;
 			}
@@ -491,9 +493,9 @@ public sealed partial class DirectExecutionBackend
 				break;
 			}
 
-			if (mbi.State == MEM_COMMIT &&
-				IsReadableProtection(mbi.Protect) &&
-				IsExecutableProtection(mbi.Protect))
+			if (mbi.State == HostRegionState.Committed &&
+				IsReadableProtection(mbi.RawProtection) &&
+				IsExecutableProtection(mbi.RawProtection))
 			{
 				ScanExecutableRegionForTargetReferences(regionBase, regionEnd, targetList, hitCounts, maxHitsPerTarget);
 			}
@@ -798,13 +800,13 @@ public sealed partial class DirectExecutionBackend
 			return false;
 		}
 
-		if (VirtualQuery((void*)address, out var mbi, (nuint)sizeof(MEMORY_BASIC_INFORMATION64)) == 0)
+		if (!_hostMemory.Query(address, out var mbi))
 		{
 			return false;
 		}
 
 		ulong regionEnd = mbi.BaseAddress + mbi.RegionSize;
-		if (mbi.State != MEM_COMMIT || !IsReadableProtection(mbi.Protect) || regionEnd <= address || address > regionEnd - 8)
+		if (mbi.State != HostRegionState.Committed || !IsReadableProtection(mbi.RawProtection) || regionEnd <= address || address > regionEnd - 8)
 		{
 			return false;
 		}
@@ -916,25 +918,25 @@ public sealed partial class DirectExecutionBackend
 		{
 			return false;
 		}
-		if (VirtualQuery((void*)faultAddress, out var mbi, (nuint)sizeof(MEMORY_BASIC_INFORMATION64)) == 0)
+		if (!_hostMemory.Query(faultAddress, out var mbi))
 		{
 			return false;
 		}
 
 		ulong pageBase = faultAddress & 0xFFFFFFFFFFFFF000uL;
-		uint commitProtect = ResolveLazyCommitProtection(accessType, mbi.AllocationProtect);
+		uint commitProtect = ResolveLazyCommitProtection(accessType, mbi.RawAllocationProtection);
 		int traceIndex = Interlocked.Increment(ref _lazyCommitTraceCount);
 		bool traceLazyCommit = ShouldTraceLazyCommit(traceIndex);
 		if (traceLazyCommit)
 		{
-			Console.Error.WriteLine($"[LOADER][TRACE] lazy-query#{traceIndex}: fault=0x{faultAddress:X16} owner={owner} rip=0x{rip:X16} rsp=0x{rsp:X16} state=0x{mbi.State:X08} base=0x{mbi.BaseAddress:X16} size=0x{mbi.RegionSize:X16} alloc=0x{mbi.AllocationProtect:X08} prot=0x{mbi.Protect:X08}");
+			Console.Error.WriteLine($"[LOADER][TRACE] lazy-query#{traceIndex}: fault=0x{faultAddress:X16} owner={owner} rip=0x{rip:X16} rsp=0x{rsp:X16} state=0x{mbi.RawState:X08} base=0x{mbi.BaseAddress:X16} size=0x{mbi.RegionSize:X16} alloc=0x{mbi.RawAllocationProtection:X08} prot=0x{mbi.RawProtection:X08}");
 		}
 
-		if (mbi.State == 4096 && IsAccessCompatible(accessType, mbi.Protect))
+		if (mbi.State == HostRegionState.Committed && IsAccessCompatible(accessType, mbi.RawProtection))
 		{
 			if (traceLazyCommit)
 			{
-				Console.Error.WriteLine($"[LOADER][TRACE] lazy-commit-race#{traceIndex}: fault=0x{faultAddress:X16} protect=0x{mbi.Protect:X08}");
+				Console.Error.WriteLine($"[LOADER][TRACE] lazy-commit-race#{traceIndex}: fault=0x{faultAddress:X16} protect=0x{mbi.RawProtection:X08}");
 			}
 			return true;
 		}
@@ -943,10 +945,10 @@ public sealed partial class DirectExecutionBackend
 		ulong committedBase = 0;
 		ulong committedSize = 0;
 
-		if (mbi.State == 65536)
+		if (mbi.State == HostRegionState.Free)
 		{
 			if (TryGetLazyCommitWindow(faultAddress, mbi.BaseAddress, mbi.RegionSize, out var windowBase, out var windowSize) &&
-				TryReserveThenCommit(windowBase, windowSize, windowBase, windowSize, commitProtect))
+				TryReserveThenCommit(_hostMemory, windowBase, windowSize, windowBase, windowSize, commitProtect))
 			{
 				committed = true;
 				committedBase = windowBase;
@@ -955,7 +957,7 @@ public sealed partial class DirectExecutionBackend
 			else
 			{
 				ulong largeBase = faultAddress & 0xFFFFFFFFFFE00000uL;
-				if (TryReserveThenCommit(largeBase, 2097152uL, largeBase, 2097152uL, commitProtect))
+				if (TryReserveThenCommit(_hostMemory, largeBase, 2097152uL, largeBase, 2097152uL, commitProtect))
 				{
 					committed = true;
 					committedBase = largeBase;
@@ -966,13 +968,13 @@ public sealed partial class DirectExecutionBackend
 			if (!committed)
 			{
 				ulong region64kBase = faultAddress & 0xFFFFFFFFFFFF0000uL;
-				if (TryReserveThenCommit(region64kBase, 65536uL, region64kBase, 65536uL, commitProtect))
+				if (TryReserveThenCommit(_hostMemory, region64kBase, 65536uL, region64kBase, 65536uL, commitProtect))
 				{
 					committed = true;
 					committedBase = region64kBase;
 					committedSize = 65536uL;
 				}
-				else if (TryReserveThenCommit(pageBase, 4096uL, pageBase, 4096uL, commitProtect))
+				else if (TryReserveThenCommit(_hostMemory, pageBase, 4096uL, pageBase, 4096uL, commitProtect))
 				{
 					committed = true;
 					committedBase = pageBase;
@@ -985,7 +987,7 @@ public sealed partial class DirectExecutionBackend
 				return false;
 			}
 
-			TryCommitRange(pageBase + 4096, 4096uL, commitProtect);
+			TryCommitRange(_hostMemory, pageBase + 4096, 4096uL, commitProtect);
 			if (traceLazyCommit)
 			{
 				Console.Error.WriteLine($"[LOADER][TRACE] lazy-reserve-commit#{traceIndex}: addr=0x{committedBase:X16} size=0x{committedSize:X16} access={accessType} protect=0x{commitProtect:X8}");
@@ -993,13 +995,13 @@ public sealed partial class DirectExecutionBackend
 			return true;
 		}
 
-		if (mbi.State != 8192)
+		if (mbi.State != HostRegionState.Reserved)
 		{
 			return false;
 		}
 
 		if (TryGetLazyCommitWindow(faultAddress, mbi.BaseAddress, mbi.RegionSize, out var commitWindowBase, out var commitWindowSize) &&
-			TryCommitRange(commitWindowBase, commitWindowSize, commitProtect))
+			TryCommitRange(_hostMemory, commitWindowBase, commitWindowSize, commitProtect))
 		{
 			committed = true;
 			committedBase = commitWindowBase;
@@ -1008,7 +1010,7 @@ public sealed partial class DirectExecutionBackend
 		else
 		{
 			ulong largeCommitBase = faultAddress & 0xFFFFFFFFFFE00000uL;
-			if (TryCommitRange(largeCommitBase, 2097152uL, commitProtect))
+			if (TryCommitRange(_hostMemory, largeCommitBase, 2097152uL, commitProtect))
 			{
 				committed = true;
 				committedBase = largeCommitBase;
@@ -1019,19 +1021,19 @@ public sealed partial class DirectExecutionBackend
 		if (!committed)
 		{
 			ulong region64kBase = faultAddress & 0xFFFFFFFFFFFF0000uL;
-			if (TryCommitRange(region64kBase, 65536uL, commitProtect))
+			if (TryCommitRange(_hostMemory, region64kBase, 65536uL, commitProtect))
 			{
 				committed = true;
 				committedBase = region64kBase;
 				committedSize = 65536uL;
 			}
-			else if (TryCommitRange(pageBase, 8192uL, commitProtect))
+			else if (TryCommitRange(_hostMemory, pageBase, 8192uL, commitProtect))
 			{
 				committed = true;
 				committedBase = pageBase;
 				committedSize = 8192uL;
 			}
-			else if (TryCommitRange(pageBase, 4096uL, commitProtect))
+			else if (TryCommitRange(_hostMemory, pageBase, 4096uL, commitProtect))
 			{
 				committed = true;
 				committedBase = pageBase;
@@ -1044,7 +1046,7 @@ public sealed partial class DirectExecutionBackend
 			return false;
 		}
 
-		TryCommitRange(pageBase + 4096, 4096uL, commitProtect);
+		TryCommitRange(_hostMemory, pageBase + 4096, 4096uL, commitProtect);
 		if (traceLazyCommit)
 		{
 			Console.Error.WriteLine($"[LOADER][TRACE] lazy-commit#{traceIndex}: addr=0x{committedBase:X16} size=0x{committedSize:X16} access={accessType} protect=0x{commitProtect:X8}");
@@ -1085,31 +1087,33 @@ public sealed partial class DirectExecutionBackend
 			return true;
 		}
 
-		static unsafe bool TryCommitRange(ulong baseAddress, ulong length, uint protection)
+		// The commit protection is one of the two raw values ResolveLazyCommitProtection
+		// produces (0x40 RWX / 0x04 RW); the enum mapping reproduces those exactly.
+		static bool TryCommitRange(IHostMemory hostMemory, ulong baseAddress, ulong length, uint protection)
 		{
 			if (length == 0)
 			{
 				return false;
 			}
-			return VirtualAlloc((void*)baseAddress, (nuint)length, 4096u, protection) != null;
+			return hostMemory.Commit(baseAddress, length, protection == 64u ? HostPageProtection.ReadWriteExecute : HostPageProtection.ReadWrite);
 		}
 
-		static unsafe bool TryReserveRange(ulong baseAddress, ulong length)
+		static bool TryReserveRange(IHostMemory hostMemory, ulong baseAddress, ulong length)
 		{
 			if (length == 0)
 			{
 				return false;
 			}
-			return VirtualAlloc((void*)baseAddress, (nuint)length, 8192u, 4u) != null;
+			return hostMemory.Reserve(baseAddress, length, HostPageProtection.ReadWrite) != 0;
 		}
 
-		static bool TryReserveThenCommit(ulong reserveAddress, ulong reserveSize, ulong commitAddress, ulong commitSize, uint protection)
+		static bool TryReserveThenCommit(IHostMemory hostMemory, ulong reserveAddress, ulong reserveSize, ulong commitAddress, ulong commitSize, uint protection)
 		{
-			if (!TryReserveRange(reserveAddress, reserveSize))
+			if (!TryReserveRange(hostMemory, reserveAddress, reserveSize))
 			{
 				return false;
 			}
-			return TryCommitRange(commitAddress, commitSize, protection);
+			return TryCommitRange(hostMemory, commitAddress, commitSize, protection);
 		}
 
 		static bool IsAccessCompatible(ulong accessType, uint protection)

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.Imports.cs

@@ -8,8 +8,10 @@ using System.Linq;
 using System.Runtime.InteropServices;
 using System.Threading;
 using SharpEmu.Core.Cpu;
+using SharpEmu.Core.Cpu.Native.Windows;
 using SharpEmu.Core.Loader;
 using SharpEmu.HLE;
+using SharpEmu.HLE.Host;
 
 namespace SharpEmu.Core.Cpu.Native;
 
@@ -69,23 +71,23 @@ public sealed partial class DirectExecutionBackend
 	private unsafe static int TryRecoverUnresolvedSentinel(void* exceptionInfo)
 	{
 		EXCEPTION_RECORD* exceptionRecord = ((EXCEPTION_POINTERS*)exceptionInfo)->ExceptionRecord;
-		if (exceptionRecord->ExceptionCode != 3221225477u)
+		if (exceptionRecord->ExceptionCode != WindowsFaultCodes.AccessViolation)
 		{
 			return 0;
 		}
 		void* contextRecord = ((EXCEPTION_POINTERS*)exceptionInfo)->ContextRecord;
-		ulong value = ReadCtxU64(contextRecord, 248);
+		ulong value = ReadCtxU64(contextRecord, CTX_RIP);
 		ulong value2 = (ulong)exceptionRecord->ExceptionAddress;
 		if (!IsUnresolvedSentinel(value) && !IsUnresolvedSentinel(value2))
 		{
 			return 0;
 		}
-		ulong rsp = ReadCtxU64(contextRecord, 152);
-		WriteCtxU64(contextRecord, 120, 0uL);
+		ulong rsp = ReadCtxU64(contextRecord, CTX_RSP);
+		WriteCtxU64(contextRecord, CTX_RAX, 0uL);
 		if (TryGetPlausibleReturnFromStack(rsp, out var returnRip, out var nextRsp))
 		{
-			WriteCtxU64(contextRecord, 152, nextRsp);
-			WriteCtxU64(contextRecord, 248, returnRip);
+			WriteCtxU64(contextRecord, CTX_RSP, nextRsp);
+			WriteCtxU64(contextRecord, CTX_RIP, returnRip);
 			Interlocked.Increment(ref _rawSentinelRecoveries);
 			if (LogThreadMode)
 			{
@@ -238,6 +240,22 @@ public sealed partial class DirectExecutionBackend
 			cpuContext[CpuRegister.Rax] = 0uL;
 			return 0uL;
 		}
+		if (_hostShutdownRequested)
+		{
+			if (isGuestWorker &&
+				TryYieldGuestThreadToHostStub(argPackPtr, num, num7, importStubEntry.Nid, "host shutdown"))
+			{
+				cpuContext[CpuRegister.Rax] = 0uL;
+				return 0uL;
+			}
+
+			if (!isGuestWorker &&
+				TryAbortGuestForHostShutdown(argPackPtr, num, num7))
+			{
+				cpuContext[CpuRegister.Rax] = 1uL;
+				return 1uL;
+			}
+		}
 		bool flag0 = ShouldSuppressStrlenTrace(importStubEntry.Nid);
 		bool flag = num7 >= 2156221920u && num7 <= 2156225024u;
 		bool flag2 = num7 >= 2156351360u && num7 <= 2156352080u;
@@ -517,8 +535,7 @@ public sealed partial class DirectExecutionBackend
 					out var blockContinuation,
 					out var hasBlockContinuation,
 					out var blockWakeKey,
-					out var blockResumeHandler,
-					out var blockWakeHandler,
+					out var blockWaiter,
 					out var blockDeadlineTimestamp) &&
 				TryYieldGuestThreadToHostStub(argPackPtr, num, num7, importStubEntry.Nid, blockReason))
 			{
@@ -528,8 +545,7 @@ public sealed partial class DirectExecutionBackend
 						GuestThreadExecution.CurrentGuestThreadHandle,
 						blockContinuation,
 						blockWakeKey,
-						blockResumeHandler,
-						blockWakeHandler,
+						blockWaiter,
 						blockDeadlineTimestamp);
 				}
 
@@ -660,8 +676,7 @@ public sealed partial class DirectExecutionBackend
 				out var blockContinuation,
 				out var hasBlockContinuation,
 				out var blockWakeKey,
-				out var blockResumeHandler,
-				out var blockWakeHandler,
+				out var blockWaiter,
 				out var blockDeadlineTimestamp) &&
 			TryYieldGuestThreadToHostStub(argPackPtr, dispatchIndex, returnRip, importStubEntry.Nid, blockReason))
 		{
@@ -671,8 +686,7 @@ public sealed partial class DirectExecutionBackend
 					GuestThreadExecution.CurrentGuestThreadHandle,
 					blockContinuation,
 					blockWakeKey,
-					blockResumeHandler,
-					blockWakeHandler,
+					blockWaiter,
 					blockDeadlineTimestamp);
 			}
 
@@ -814,10 +828,10 @@ public sealed partial class DirectExecutionBackend
 			return !_logUsleep;
 		}
 
-		// Only mutex/rwlock *lock* is excluded: it may block a contended acquire, which the
-		// leaf path can't. unlock never blocks and stays here — routing it off the fast path
-		// slows guest spinlocks enough to livelock (Demon's Souls).
+		// Mutex lock uses this block-capable leaf path. Keep it out of the no-block subset.
 		return nid is
+			"9UK1vLZQft4" or // scePthreadMutexLock
+			"7H0iTOciTLo" or // pthread_mutex_lock
 			"tn3VlD0hG60" or // scePthreadMutexUnlock
 			"2Z+PpY6CaJg" or // pthread_mutex_unlock
 			"EgmLo6EWgso" or // pthread_rwlock_unlock
@@ -975,6 +989,31 @@ public sealed partial class DirectExecutionBackend
 		return true;
 	}
 
+	private unsafe bool TryAbortGuestForHostShutdown(nint argPackPtr, long dispatchIndex, ulong returnRip)
+	{
+		ulong hostExit = ActiveEntryReturnSentinelRip;
+		if (hostExit < 65536 || !TryPatchActiveGuestReturnSlot(hostExit))
+		{
+			return false;
+		}
+		try
+		{
+			*(ulong*)(argPackPtr + 96) = hostExit;
+		}
+		catch
+		{
+			return false;
+		}
+		ActiveForcedGuestExit = true;
+		if (string.IsNullOrWhiteSpace(LastError))
+		{
+			LastError = "Host shutdown requested.";
+		}
+		Console.Error.WriteLine(
+			$"[LOADER][INFO] Guest unwind for host shutdown at import#{dispatchIndex} ret=0x{returnRip:X16} -> host_exit=0x{hostExit:X16}");
+		return true;
+	}
+
 	private unsafe bool TryCompleteGuestEntryToHostStub(nint argPackPtr, long dispatchIndex, ulong returnRip, string nid, string reason, ulong value)
 	{
 		ulong hostExit = ActiveEntryReturnSentinelRip;
@@ -1684,9 +1723,9 @@ public sealed partial class DirectExecutionBackend
 		{
 			var candidateBase = ImportStubRegionCanonicalBase -
 				(ulong)candidateIndex * ImportStubRegionAddressStride;
-			if (VirtualQuery((void*)candidateBase, out var memoryInfo, (nuint)sizeof(MEMORY_BASIC_INFORMATION64)) == 0 ||
+			if (!_hostMemory.Query(candidateBase, out var memoryInfo) ||
 				memoryInfo.RegionSize == 0 ||
-				memoryInfo.State != 4096)
+				memoryInfo.State != HostRegionState.Committed)
 			{
 				continue;
 			}
@@ -1927,23 +1966,36 @@ public sealed partial class DirectExecutionBackend
 			return false;
 		}
 
-		List<byte> list = new List<byte>(Math.Min(maxLength, 256));
-		Span<byte> destination = stackalloc byte[1];
-		for (int i = 0; i < maxLength; i++)
+		// Reads stay byte-by-byte through TryReadByteCompat (its Marshal.ReadByte
+		// fallback must probe exactly up to the terminator), but the bytes land in a
+		// stack buffer instead of a List<byte> + ToArray per symbol resolution.
+		const int StackBufferLength = 512;
+		byte[]? rented = maxLength > StackBufferLength ? System.Buffers.ArrayPool<byte>.Shared.Rent(maxLength) : null;
+		Span<byte> buffer = rented is null ? stackalloc byte[StackBufferLength] : rented;
+		try
 		{
-			if (!TryReadByteCompat(address + (ulong)i, destination))
+			for (int i = 0; i < maxLength; i++)
 			{
-				return false;
+				if (!TryReadByteCompat(address + (ulong)i, buffer.Slice(i, 1)))
+				{
+					return false;
+				}
+				if (buffer[i] == 0)
+				{
+					value = System.Text.Encoding.ASCII.GetString(buffer[..i]);
+					return true;
+				}
+			}
+			value = System.Text.Encoding.ASCII.GetString(buffer[..maxLength]);
+			return true;
+		}
+		finally
+		{
+			if (rented is not null)
+			{
+				System.Buffers.ArrayPool<byte>.Shared.Return(rented);
 			}
-			if (destination[0] == 0)
-			{
-				value = System.Text.Encoding.ASCII.GetString(list.ToArray());
-				return true;
-			}
-			list.Add(destination[0]);
 		}
-		value = System.Text.Encoding.ASCII.GetString(list.ToArray());
-		return true;
 	}
 
 	private bool TryReadByteCompat(ulong address, Span<byte> destination)
@@ -2025,7 +2077,7 @@ public sealed partial class DirectExecutionBackend
 		uint flNewProtect = default(uint);
 		try
 		{
-			if (Marshal.ReadByte(num2) != 232 || !VirtualProtect((void*)num, 5u, 64u, &flNewProtect))
+			if (Marshal.ReadByte(num2) != 232 || !_hostMemory.Protect((ulong)(void*)num, 5u, HostPageProtection.ReadWriteExecute, out flNewProtect))
 			{
 				return;
 			}
@@ -2033,7 +2085,7 @@ public sealed partial class DirectExecutionBackend
 			{
 				Marshal.WriteByte(num2 + i, 144);
 			}
-			FlushInstructionCache(GetCurrentProcess(), (void*)num, 5u);
+			_hostMemory.FlushInstructionCache((ulong)(void*)num, 5u);
 			_patchedEa020eLookupCall = true;
 			Console.Error.WriteLine($"[LOADER][WARNING] Import#{dispatchIndex}: patched hash-lookup call at 0x{num:X16} -> NOP*5");
 		}
@@ -2044,7 +2096,7 @@ public sealed partial class DirectExecutionBackend
 		{
 			if (flNewProtect != 0)
 			{
-				VirtualProtect((void*)num, 5u, flNewProtect, &flNewProtect);
+				_hostMemory.ProtectRaw((ulong)(void*)num, 5u, flNewProtect, out flNewProtect);
 			}
 		}
 	}

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.NativeWorker.cs

@@ -6,6 +6,7 @@ using System.Collections.Generic;
 using System.Runtime.InteropServices;
 using System.Threading;
 using SharpEmu.HLE;
+using SharpEmu.HLE.Host;
 
 namespace SharpEmu.Core.Cpu.Native;
 
@@ -35,20 +36,6 @@ public sealed partial class DirectExecutionBackend
 	private bool _nativeWorkersDisposed;
 	private int _nativeWorkerCreationFailedLogged;
 
-	private const uint StackSizeParamIsAReservation = 0x00010000u;
-
-	[DllImport("kernel32.dll", SetLastError = true)]
-	private static extern nint CreateThread(
-		nint lpThreadAttributes,
-		nuint dwStackSize,
-		nint lpStartAddress,
-		nint lpParameter,
-		uint dwCreationFlags,
-		out uint lpThreadId);
-
-	[DllImport("kernel32.dll", SetLastError = true)]
-	private static extern uint WaitForSingleObject(nint hHandle, uint dwMilliseconds);
-
 	// Runs an emitted guest entry stub. Preferred path is a pooled native worker
 	// thread; falls back to the historical inline calli (guest frames above this
 	// thread's managed frames) when workers are disabled or unavailable.
@@ -61,7 +48,7 @@ public sealed partial class DirectExecutionBackend
 		var worker = RentNativeGuestExecutor();
 		if (worker is null)
 		{
-			TlsSetValue(_hostRspSlotTlsIndex, (nint)hostRspSlot);
+			_hostThreading.SetTlsValue(_hostRspSlotTlsIndex, (nint)hostRspSlot);
 			return CallNativeEntry(entryStub);
 		}
 		try
@@ -229,7 +216,7 @@ public sealed partial class DirectExecutionBackend
 
 		public static NativeGuestExecutor? TryCreate(DirectExecutionBackend backend)
 		{
-			if (!EnsureKernel32Exports())
+			if (!EnsureHostRuntimeExports(backend._hostSymbols))
 			{
 				return null;
 			}
@@ -242,32 +229,27 @@ public sealed partial class DirectExecutionBackend
 			return executor;
 		}
 
-		private static bool EnsureKernel32Exports()
+		private static bool EnsureHostRuntimeExports(IHostSymbolResolver symbols)
 		{
 			if (_exitThreadAddress != 0)
 			{
 				return _waitForSingleObjectAddress != 0 && _setEventAddress != 0;
 			}
-			nint kernel32 = GetModuleHandle("kernel32.dll");
-			if (kernel32 == 0)
-			{
-				return false;
-			}
-			_waitForSingleObjectAddress = GetProcAddress(kernel32, "WaitForSingleObject");
-			_setEventAddress = GetProcAddress(kernel32, "SetEvent");
-			_exitThreadAddress = GetProcAddress(kernel32, "ExitThread");
+			_waitForSingleObjectAddress = symbols.GetAddress(HostRuntimeFunction.WaitForSingleObject);
+			_setEventAddress = symbols.GetAddress(HostRuntimeFunction.SetEvent);
+			_exitThreadAddress = symbols.GetAddress(HostRuntimeFunction.ExitThread);
 			return _waitForSingleObjectAddress != 0 && _setEventAddress != 0 && _exitThreadAddress != 0;
 		}
 
 		private bool Initialize()
 		{
 			_selfHandle = GCHandle.Alloc(this);
-			_controlBlock = VirtualAlloc(null, 4096u, 12288u, 4u);
+			_controlBlock = (void*)_backend._hostMemory.Allocate(0, 4096u, HostPageProtection.ReadWrite);
 			if (_controlBlock == null)
 			{
 				return false;
 			}
-			_loopStub = VirtualAlloc(null, LoopStubSize, 12288u, 64u);
+			_loopStub = (void*)_backend._hostMemory.Allocate(0, LoopStubSize, HostPageProtection.ReadWriteExecute);
 			if (_loopStub == null)
 			{
 				return false;
@@ -349,17 +331,15 @@ public sealed partial class DirectExecutionBackend
 			*(int*)(code + skipJump) = skipEntryOffset - (skipJump + sizeof(int));
 
 			uint oldProtect = 0;
-			if (!VirtualProtect(_loopStub, LoopStubSize, 32u, &oldProtect))
+			if (!_backend._hostMemory.Protect((ulong)_loopStub, LoopStubSize, HostPageProtection.ReadExecute, out oldProtect))
 			{
 				return false;
 			}
-			FlushInstructionCache(GetCurrentProcess(), _loopStub, LoopStubSize);
-			_threadHandle = CreateThread(
-				0,
-				WorkerStackReservation,
+			_backend._hostMemory.FlushInstructionCache((ulong)_loopStub, LoopStubSize);
+			_threadHandle = _backend._hostThreading.CreateNativeThread(
 				(nint)_loopStub,
 				0,
-				StackSizeParamIsAReservation,
+				WorkerStackReservation,
 				out _nativeThreadId);
 			if (_threadHandle == 0)
 			{
@@ -465,7 +445,7 @@ public sealed partial class DirectExecutionBackend
 			_prevYieldRequested = _activeGuestThreadYieldRequested;
 			_prevYieldReason = _activeGuestThreadYieldReason;
 			_prevState = _activeGuestThreadState;
-			_prevHostRspSlot = TlsGetValue(backend._hostRspSlotTlsIndex);
+			_prevHostRspSlot = backend._hostThreading.GetTlsValue(backend._hostRspSlotTlsIndex);
 			_prevGuestThreadHandle = GuestThreadExecution.EnterGuestThread(_runGuestThreadHandle);
 			_entered = true;
 			_activeExecutionBackend = backend;
@@ -477,11 +457,11 @@ public sealed partial class DirectExecutionBackend
 			_activeGuestThreadYieldReason = null;
 			_activeGuestThreadState = _runState;
 			backend.BindTlsBase(_runContext!);
-			TlsSetValue(backend._hostRspSlotTlsIndex, _runHostRspSlot);
+			backend._hostThreading.SetTlsValue(backend._hostRspSlotTlsIndex, _runHostRspSlot);
 			if (_runState is { } state)
 			{
 				_prevHostThreadId = Volatile.Read(ref state.HostThreadId);
-				Volatile.Write(ref state.HostThreadId, unchecked((int)GetCurrentThreadId()));
+				Volatile.Write(ref state.HostThreadId, unchecked((int)backend._hostThreading.CurrentThreadId));
 			}
 			if (_runAffinityMask != 0)
 			{
@@ -511,7 +491,7 @@ public sealed partial class DirectExecutionBackend
 			{
 				Volatile.Write(ref state.HostThreadId, _prevHostThreadId);
 			}
-			TlsSetValue(_backend._hostRspSlotTlsIndex, _prevHostRspSlot);
+			_backend._hostThreading.SetTlsValue(_backend._hostRspSlotTlsIndex, _prevHostRspSlot);
 			GuestThreadExecution.RestoreGuestThread(_prevGuestThreadHandle);
 			_activeExecutionBackend = _prevBackend;
 			_activeCpuContext = _prevContext;
@@ -548,8 +528,8 @@ public sealed partial class DirectExecutionBackend
 			var exited = _threadHandle == 0;
 			if (_threadHandle != 0)
 			{
-				exited = WaitForSingleObject(_threadHandle, 1000u) == 0u;
-				CloseHandle(_threadHandle);
+				exited = _backend._hostThreading.WaitForThreadExit(_threadHandle, 1000u);
+				_backend._hostThreading.CloseThreadHandle(_threadHandle);
 				_threadHandle = 0;
 			}
 			if (!exited)
@@ -563,12 +543,12 @@ public sealed partial class DirectExecutionBackend
 			}
 			if (_loopStub != null)
 			{
-				VirtualFree(_loopStub, 0u, 32768u);
+				_backend._hostMemory.Free((ulong)_loopStub);
 				_loopStub = null;
 			}
 			if (_controlBlock != null)
 			{
-				VirtualFree(_controlBlock, 0u, 32768u);
+				_backend._hostMemory.Free((ulong)_controlBlock);
 				_controlBlock = null;
 			}
 			if (_selfHandle.IsAllocated)

src/SharpEmu.Core/Cpu/Native/StubManager.cs

@@ -3,6 +3,7 @@
 
 using System.Runtime.InteropServices;
 using SharpEmu.HLE;
+using SharpEmu.HLE.Host;
 
 namespace SharpEmu.Core.Cpu.Native;
 
@@ -11,17 +12,15 @@ public sealed unsafe class StubManager : IDisposable
     private readonly List<nint> _allocatedStubs = new();
     private readonly Dictionary<string, nint> _importHandlers = new();
     private readonly Dictionary<ulong, nint> _stubAddresses = new();
+    private readonly IHostMemory _hostMemory;
     private byte* _pltMemory;
     private int _pltOffset;
     private const int PltMemorySize = 1024 * 1024; // 1MB for stubs
 
-    public StubManager()
+    public StubManager(IHostMemory? hostMemory = null)
     {
-        _pltMemory = (byte*)VirtualAlloc(
-            null,
-            (nuint)PltMemorySize,
-            AllocationType.Reserve | AllocationType.Commit,
-            MemoryProtection.ExecuteReadWrite);
+        _hostMemory = hostMemory ?? HostPlatform.Current.Memory;
+        _pltMemory = (byte*)_hostMemory.Allocate(0, PltMemorySize, HostPageProtection.ReadWriteExecute);
 
         if (_pltMemory == null)
         {
@@ -185,7 +184,7 @@ public sealed unsafe class StubManager : IDisposable
     {
         if (_pltMemory != null)
         {
-            VirtualFree(_pltMemory, 0, FreeType.Release);
+            _hostMemory.Free((ulong)_pltMemory);
             _pltMemory = null;
         }
 
@@ -194,29 +193,5 @@ public sealed unsafe class StubManager : IDisposable
         _stubAddresses.Clear();
     }
 
-    [DllImport("kernel32.dll", SetLastError = true)]
-    private static extern void* VirtualAlloc(void* lpAddress, nuint dwSize, AllocationType flAllocationType, MemoryProtection flProtect);
-
-    [DllImport("kernel32.dll", SetLastError = true)]
-    private static extern bool VirtualFree(void* lpAddress, nuint dwSize, FreeType dwFreeType);
-
-    [Flags]
-    private enum AllocationType : uint
-    {
-        Commit = 0x1000,
-        Reserve = 0x2000,
-    }
-
-    [Flags]
-    private enum MemoryProtection : uint
-    {
-        ExecuteReadWrite = 0x40,
-    }
-
-    private enum FreeType : uint
-    {
-        Release = 0x8000,
-    }
-
     public delegate void ImportHandler(CpuContext context);
 }

src/SharpEmu.Core/Cpu/Native/Windows/Win64ContextOffsets.cs

@@ -0,0 +1,32 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.Core.Cpu.Native.Windows;
+
+/// <summary>
+/// Byte offsets into the Win64 CONTEXT record delivered to vectored exception
+/// handlers. The handlers read/write guest registers directly at these offsets
+/// (no managed CONTEXT struct exists); a future POSIX backend gets a sibling
+/// class for its mcontext layout.
+/// </summary>
+internal static class Win64ContextOffsets
+{
+    public const int Mxcsr = 52;
+    public const int Rax = 120;
+    public const int Rcx = 128;
+    public const int Rdx = 136;
+    public const int Rbx = 144;
+    public const int Rsp = 152;
+    public const int Rbp = 160;
+    public const int Rsi = 168;
+    public const int Rdi = 176;
+    public const int R8 = 184;
+    public const int R9 = 192;
+    public const int R10 = 200;
+    public const int R11 = 208;
+    public const int R12 = 216;
+    public const int R13 = 224;
+    public const int R14 = 232;
+    public const int R15 = 240;
+    public const int Rip = 248;
+}

src/SharpEmu.Core/Cpu/Native/Windows/WindowsFaultCodes.cs

@@ -0,0 +1,24 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.Core.Cpu.Native.Windows;
+
+/// <summary>
+/// Windows NTSTATUS exception codes and EXCEPTION_RECORD access-type values the
+/// fault handlers filter on. Values are the same numbers the handlers previously
+/// compared as bare literals; only the spelling changed.
+/// </summary>
+internal static class WindowsFaultCodes
+{
+    public const uint AccessViolation = 0xC0000005u;         // 3221225477
+    public const uint Breakpoint = 0x80000003u;              // 2147483651
+    public const uint IllegalInstruction = 0xC000001Du;      // 3221225501
+    public const uint FastFail = 0xC0000409u;                // 3221226505
+    public const uint StackOverflow = 0xC00000FDu;
+    public const uint ClrManagedException = 0xE0434352u;
+
+    // EXCEPTION_RECORD.ExceptionInformation[0] for access violations.
+    public const ulong AccessRead = 0;
+    public const ulong AccessWrite = 1;
+    public const ulong AccessExecute = 8;
+}

src/SharpEmu.Core/Cpu/Native/Windows/WindowsFaultHandling.cs

@@ -0,0 +1,191 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Runtime.InteropServices;
+using SharpEmu.HLE.Host;
+
+namespace SharpEmu.Core.Cpu.Native.Windows;
+
+/// <summary>
+/// Vectored-exception-handler installation and the handler pre-filter thunk.
+/// The thunk is inherently Windows-shaped (TEB stack-limit reads via gs:,
+/// NTSTATUS pre-filtering, Win64 calling convention) and moved here whole from
+/// DirectExecutionBackend; a POSIX backend supplies a sibling built around
+/// sigaction/sigaltstack instead.
+/// </summary>
+internal sealed unsafe partial class WindowsFaultHandling : IHostFaultHandling
+{
+    private readonly IHostMemory _memory;
+
+    public WindowsFaultHandling(IHostMemory memory)
+    {
+        _memory = memory;
+    }
+
+    public nint CreateHandlerThunk(nint managedCallback, uint hostRspSwitchTlsSlot, nint tlsGetValueAddress)
+    {
+        const uint stubSize = 256u;
+        void* ptr = (void*)_memory.Allocate(0, stubSize, HostPageProtection.ReadWriteExecute);
+        if (ptr == null)
+        {
+            return 0;
+        }
+
+        byte* code = (byte*)ptr;
+        int offset = 0;
+        // Native pre-filter: these exception codes are raised while the thread can be in
+        // cooperative GC mode (a C# throw is RaiseException(0xE0434352) on the throwing
+        // thread; FailFast/stack-overflow arrive mid-runtime-failure). Entering the managed
+        // handler then trips the CLR's reverse-P/Invoke check and kills the process with
+        // "Invalid Program: attempted to call a UnmanagedCallersOnly method from managed
+        // code" — this is why no managed throw (even one with a catch handler) ever
+        // survived inside the emulator. Continue the handler search without touching
+        // managed code; the CLR's own VEH handles its exceptions. MSVC C++ exceptions
+        // (Vulkan drivers, host CRT) are excluded too: the managed handler only ever
+        // returned CONTINUE_SEARCH for them.
+        ReadOnlySpan<uint> nonManagedExceptionCodes =
+            [WindowsFaultCodes.ClrManagedException, 0xE06D7363u, WindowsFaultCodes.FastFail, WindowsFaultCodes.StackOverflow];
+        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x01); // mov rax, [rcx] (ExceptionRecord*)
+        EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x00);                                   // mov eax, [rax] (ExceptionCode)
+        var passJumpOffsets = stackalloc int[nonManagedExceptionCodes.Length];
+        for (int i = 0; i < nonManagedExceptionCodes.Length; i++)
+        {
+            EmitByte(code, ref offset, 0x3D);                                                                 // cmp eax, imm32
+            EmitUInt32(code, ref offset, nonManagedExceptionCodes[i]);
+            EmitByte(code, ref offset, 0x74);                                                                 // je pass
+            passJumpOffsets[i] = offset;
+            EmitByte(code, ref offset, 0x00);
+        }
+        EmitByte(code, ref offset, 0xEB); EmitByte(code, ref offset, 0x03);                                   // jmp over pass block
+        int passOffset = offset;
+        EmitByte(code, ref offset, 0x31); EmitByte(code, ref offset, 0xC0);                                   // pass: xor eax, eax (EXCEPTION_CONTINUE_SEARCH)
+        EmitByte(code, ref offset, 0xC3);                                                                     // ret
+        for (int i = 0; i < nonManagedExceptionCodes.Length; i++)
+        {
+            code[passJumpOffsets[i]] = checked((byte)(passOffset - (passJumpOffsets[i] + 1)));
+        }
+        EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x54); // push r12
+        EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x55); // push r13
+        EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xE4); // mov r12, rsp
+        EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xCD); // mov r13, rcx
+        EmitByte(code, ref offset, 0x65); EmitByte(code, ref offset, 0x48); // mov rax, gs:[8]
+        EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x04); EmitByte(code, ref offset, 0x25);
+        EmitUInt32(code, ref offset, 8u);
+        EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0x39); EmitByte(code, ref offset, 0xC4); // cmp r12, rax
+        EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0x83); // jae guestStack
+        int aboveStackJump = offset;
+        EmitUInt32(code, ref offset, 0u);
+        EmitByte(code, ref offset, 0x65); EmitByte(code, ref offset, 0x48); // mov rax, gs:[0x10]
+        EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x04); EmitByte(code, ref offset, 0x25);
+        EmitUInt32(code, ref offset, 0x10u);
+        EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0x39); EmitByte(code, ref offset, 0xC4); // cmp r12, rax
+        EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0x82); // jb guestStack
+        int belowStackJump = offset;
+        EmitUInt32(code, ref offset, 0u);
+
+        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83); EmitByte(code, ref offset, 0xEC); EmitByte(code, ref offset, 0x28);
+        EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xE9); // mov rcx, r13
+        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
+        *(nint*)(code + offset) = managedCallback;
+        offset += sizeof(nint);
+        EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xD0);
+        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83); EmitByte(code, ref offset, 0xC4); EmitByte(code, ref offset, 0x28);
+        EmitByte(code, ref offset, 0xE9);
+        int hostRestoreJump = offset;
+        EmitUInt32(code, ref offset, 0u);
+
+        int guestStackOffset = offset;
+        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83); EmitByte(code, ref offset, 0xEC); EmitByte(code, ref offset, 0x28);
+        EmitByte(code, ref offset, 0xB9);
+        EmitUInt32(code, ref offset, hostRspSwitchTlsSlot);
+        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
+        *(nint*)(code + offset) = tlsGetValueAddress;
+        offset += sizeof(nint);
+        EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xD0);
+        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83); EmitByte(code, ref offset, 0xC4); EmitByte(code, ref offset, 0x28);
+        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x85); EmitByte(code, ref offset, 0xC0); // test rax, rax
+        EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0x84);
+        int missingTlsJump = offset;
+        EmitUInt32(code, ref offset, 0u);
+        EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x18); // mov r11, [rax]
+        EmitByte(code, ref offset, 0x4D); EmitByte(code, ref offset, 0x85); EmitByte(code, ref offset, 0xDB); // test r11, r11
+        EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0x84);
+        int missingHostStackJump = offset;
+        EmitUInt32(code, ref offset, 0u);
+        EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xDC); // mov rsp, r11
+        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83); EmitByte(code, ref offset, 0xEC); EmitByte(code, ref offset, 0x28);
+        EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xE9); // mov rcx, r13
+        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
+        *(nint*)(code + offset) = managedCallback;
+        offset += sizeof(nint);
+        EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xD0);
+        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83); EmitByte(code, ref offset, 0xC4); EmitByte(code, ref offset, 0x28);
+        EmitByte(code, ref offset, 0xE9);
+        int guestRestoreJump = offset;
+        EmitUInt32(code, ref offset, 0u);
+
+        int passThroughOffset = offset;
+        EmitByte(code, ref offset, 0x31); EmitByte(code, ref offset, 0xC0); // xor eax, eax
+        int restoreOffset = offset;
+        EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xE4); // mov rsp, r12
+        EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x5D);
+        EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x5C);
+        EmitByte(code, ref offset, 0xC3);
+
+        *(int*)(code + aboveStackJump) = guestStackOffset - (aboveStackJump + sizeof(int));
+        *(int*)(code + belowStackJump) = guestStackOffset - (belowStackJump + sizeof(int));
+        *(int*)(code + hostRestoreJump) = restoreOffset - (hostRestoreJump + sizeof(int));
+        *(int*)(code + missingTlsJump) = passThroughOffset - (missingTlsJump + sizeof(int));
+        *(int*)(code + missingHostStackJump) = passThroughOffset - (missingHostStackJump + sizeof(int));
+        *(int*)(code + guestRestoreJump) = restoreOffset - (guestRestoreJump + sizeof(int));
+
+        if (!_memory.Protect((ulong)ptr, stubSize, HostPageProtection.ReadExecute, out _))
+        {
+            Console.Error.WriteLine($"[LOADER][ERROR] VirtualProtect failed for exception handler trampoline at 0x{(nint)ptr:X16}");
+            _ = _memory.Free((ulong)ptr);
+            return 0;
+        }
+        _memory.FlushInstructionCache((ulong)ptr, (ulong)offset);
+        return (nint)ptr;
+    }
+
+    public void FreeThunk(nint thunk)
+    {
+        _ = _memory.Free((ulong)thunk);
+    }
+
+    public nint AddFirstChanceHandler(nint thunk)
+    {
+        return (nint)AddVectoredExceptionHandler(1u, thunk);
+    }
+
+    public void RemoveHandler(nint handle)
+    {
+        _ = RemoveVectoredExceptionHandler((void*)handle);
+    }
+
+    public void SetUnhandledFilter(nint thunk)
+    {
+        _ = SetUnhandledExceptionFilter(thunk);
+    }
+
+    private static void EmitByte(byte* code, ref int offset, byte value)
+    {
+        code[offset++] = value;
+    }
+
+    private static void EmitUInt32(byte* code, ref int offset, uint value)
+    {
+        *(uint*)(code + offset) = value;
+        offset += sizeof(uint);
+    }
+
+    [LibraryImport("kernel32.dll")]
+    private static partial void* AddVectoredExceptionHandler(uint first, IntPtr handler);
+
+    [LibraryImport("kernel32.dll")]
+    private static partial uint RemoveVectoredExceptionHandler(void* handle);
+
+    [LibraryImport("kernel32.dll")]
+    private static partial IntPtr SetUnhandledExceptionFilter(IntPtr lpTopLevelExceptionFilter);
+}

src/SharpEmu.Core/Cpu/TrackedCpuMemory.cs

@@ -5,7 +5,7 @@ using SharpEmu.HLE;
 
 namespace SharpEmu.Core.Cpu;
 
-public sealed class TrackedCpuMemory : ICpuMemory, ITrackedCpuMemory, IGuestMemoryAllocator
+public sealed class TrackedCpuMemory : ICpuMemory, ITrackedCpuMemory, IGuestMemoryAllocator, ICpuMemoryWrapper
 {
     private readonly ICpuMemory _inner;
 
@@ -50,4 +50,9 @@ public sealed class TrackedCpuMemory : ICpuMemory, ITrackedCpuMemory, IGuestMemo
         address = 0;
         return false;
     }
+
+    public bool TryFreeGuestMemory(ulong address)
+    {
+        return _inner is IGuestMemoryAllocator allocator && allocator.TryFreeGuestMemory(address);
+    }
 }

src/SharpEmu.Core/Loader/SelfLoader.cs

@@ -17,7 +17,9 @@ namespace SharpEmu.Core.Loader;
 public sealed class SelfLoader : ISelfLoader
 {
     private static readonly SharpEmuLogger Log = SharpEmuLog.For("Loader");
-    private const uint SelfMagic = 0x4F153D1D;
+    private const uint ElfMagic = 0x7F454C46;
+    private const uint Ps4SelfMagic  = 0x4F153D1D;
+    private const uint Ps5SelfMagic  = 0x5414F5EE;
     private const ulong SelfSegmentFlag = 0x800;
     private const int PageSize = 0x1000;
     private const ulong ImportStubBaseAddress = 0x0000_7000_0000_0000UL;
@@ -323,7 +325,8 @@ public sealed class SelfLoader : ISelfLoader
             throw new InvalidDataException("Input image is too small to contain an ELF header.");
         }
 
-        if (imageData.Length >= sizeof(uint) && BinaryPrimitives.ReadUInt32BigEndian(imageData[..sizeof(uint)]) == SelfMagic)
+        var magic = BinaryPrimitives.ReadUInt32BigEndian(imageData[..sizeof(uint)]);
+        if (magic is Ps4SelfMagic or Ps5SelfMagic)
         {
             var selfHeader = ReadUnmanaged<SelfHeader>(imageData, 0);
             if (!selfHeader.HasKnownLayout || selfHeader.Unknown != 0x22)
@@ -345,6 +348,12 @@ public sealed class SelfLoader : ISelfLoader
             return new LoadContext(IsSelf: true, elfOffset, selfHeader.FileSize, segments);
         }
 
+        if (magic != ElfMagic)
+        {
+            throw new InvalidDataException(
+                $"Unsupported executable signature 0x{magic:X8}");
+        }
+
         return new LoadContext(IsSelf: false, ElfOffset: 0, SelfFileSize: 0, Array.Empty<SelfSegment>());
     }
 
@@ -2380,10 +2389,14 @@ public sealed class SelfLoader : ISelfLoader
         public ulong FileSize => _fileSize;
 
         public bool HasKnownLayout =>
-            _ident0 == 0x4F &&
-            _ident1 == 0x15 &&
-            _ident2 == 0x3D &&
-            _ident3 == 0x1D &&
+            ((_ident0 == 0x4F &&
+              _ident1 == 0x15 &&
+              _ident2 == 0x3D &&
+              _ident3 == 0x1D) ||
+             (_ident0 == 0x54 &&
+              _ident1 == 0x14 &&
+              _ident2 == 0xF5 &&
+              _ident3 == 0xEE)) &&
             _ident4 == 0x00 &&
             _ident5 == 0x01 &&
             _ident6 == 0x01 &&

src/SharpEmu.Core/Memory/PhysicalVirtualMemory.cs

@@ -4,11 +4,12 @@
 using System.Runtime.InteropServices;
 using SharpEmu.Core.Loader;
 using SharpEmu.HLE;
+using SharpEmu.HLE.Host;
 using SharpEmu.Logging;
 
 namespace SharpEmu.Core.Memory;
 
-public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryAllocator, IDisposable
+public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryAllocator, IGuestAddressSpace, IDisposable
 {
     private static readonly SharpEmuLogger Log = SharpEmuLog.For("VMEM");
 
@@ -28,41 +29,27 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
     private const ulong DefaultLazyReservePrimeBytes = 0x0400_0000UL; // 64 MiB
     private const ulong LazyReservePrimeChunkBytes = 0x0200_0000UL; // 32 MiB
 
-    private const uint MEM_COMMIT = 0x1000;
-    private const uint MEM_RESERVE = 0x2000;
-    private const uint MEM_RELEASE = 0x8000;
+    // Raw Windows PAGE_* values retained for the internal region/protection
+    // bookkeeping: regions and saved old-protection values always carry the raw
+    // value of the host platform in use, and these classification helpers only
+    // ever see values this class itself assigned (see IHostMemory.ProtectRaw).
     private const uint PAGE_EXECUTE_READ = 0x20;
     private const uint PAGE_EXECUTE_READWRITE = 0x40;
     private const uint PAGE_EXECUTE = 0x10;
     private const uint PAGE_EXECUTE_WRITECOPY = 0x80;
-    private const uint PAGE_NOACCESS = 0x01;
     private const uint PAGE_READWRITE = 0x04;
     private const uint PAGE_READONLY = 0x02;
 
+    private readonly IHostMemory _hostMemory;
     private ulong _guestAllocationArenaBase;
-    private ulong _guestAllocationOffset;
+    private readonly SortedDictionary<ulong, ulong> _guestAllocationFreeRanges = new();
+    private readonly Dictionary<ulong, (ulong Offset, ulong Size)> _guestAllocations = new();
     private static readonly ulong LazyReservePrimeBytes = ResolveLazyReservePrimeBytes();
 
-    [DllImport("kernel32.dll", SetLastError = true)]
-    private static extern void* VirtualAlloc(void* lpAddress, nuint dwSize, uint flAllocationType, uint flProtect);
-
-    [DllImport("kernel32.dll", SetLastError = true)]
-    [return: MarshalAs(UnmanagedType.Bool)]
-    private static extern bool VirtualFree(void* lpAddress, nuint dwSize, uint dwFreeType);
-
-    [DllImport("kernel32.dll", SetLastError = true)]
-    [return: MarshalAs(UnmanagedType.Bool)]
-    private static extern bool VirtualProtect(void* lpAddress, nuint dwSize, uint flNewProtect, out uint lpflOldProtect);
-
-    [DllImport("kernel32.dll")]
-    private static extern nuint VirtualQuery(void* lpAddress, out MemoryBasicInformation64 lpBuffer, nuint dwLength);
-
-    [DllImport("kernel32.dll")]
-    private static extern void* GetCurrentProcess();
-
-    [DllImport("kernel32.dll", SetLastError = true)]
-    [return: MarshalAs(UnmanagedType.Bool)]
-    private static extern bool FlushInstructionCache(void* hProcess, void* lpBaseAddress, nuint dwSize);
+    public PhysicalVirtualMemory(IHostMemory? hostMemory = null)
+    {
+        _hostMemory = hostMemory ?? HostPlatform.Current.Memory;
+    }
 
     public bool TryAllocateAtExact(ulong desiredAddress, ulong size, bool executable, out ulong actualAddress)
     {
@@ -74,17 +61,17 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
 
         var alignedSize = (size + 0xFFF) & ~0xFFFUL;
         var protection = executable ? PAGE_EXECUTE_READWRITE : PAGE_READWRITE;
-        var allocationType = MEM_COMMIT | MEM_RESERVE;
-        var result = VirtualAlloc((void*)desiredAddress, (nuint)alignedSize, allocationType, protection);
-        if (result == null)
+        var hostProtection = executable ? HostPageProtection.ReadWriteExecute : HostPageProtection.ReadWrite;
+        var result = _hostMemory.Allocate(desiredAddress, alignedSize, hostProtection);
+        if (result == 0)
         {
             return false;
         }
 
-        actualAddress = (ulong)result;
+        actualAddress = result;
         if (actualAddress != desiredAddress)
         {
-            VirtualFree(result, 0, MEM_RELEASE);
+            _hostMemory.Free(result);
             actualAddress = 0;
             return false;
         }
@@ -119,33 +106,33 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         var alignedSize = (size + 0xFFF) & ~0xFFFUL;
 
         var protection = executable ? PAGE_EXECUTE_READWRITE : PAGE_READWRITE;
-        var allocationType = MEM_COMMIT | MEM_RESERVE;
+        var hostProtection = executable ? HostPageProtection.ReadWriteExecute : HostPageProtection.ReadWrite;
         var reservedOnly = false;
         var preferReserveOnly = !executable &&
             alignedSize >= LargeDataReserveThreshold &&
             alignedSize > FullCommitRegionLimit;
 
-        void* result = null;
+        ulong result = 0;
         if (preferReserveOnly)
         {
-            result = VirtualAlloc((void*)desiredAddress, (nuint)alignedSize, MEM_RESERVE, PAGE_READWRITE);
-            if (result == null && allowAlternative)
+            result = _hostMemory.Reserve(desiredAddress, alignedSize, HostPageProtection.ReadWrite);
+            if (result == 0 && allowAlternative)
             {
-                result = VirtualAlloc(null, (nuint)alignedSize, MEM_RESERVE, PAGE_READWRITE);
+                result = _hostMemory.Reserve(0, alignedSize, HostPageProtection.ReadWrite);
             }
 
-            if (result != null)
+            if (result != 0)
             {
                 reservedOnly = true;
             }
         }
 
-        if (result == null)
+        if (result == 0)
         {
-            result = VirtualAlloc((void*)desiredAddress, (nuint)alignedSize, allocationType, protection);
+            result = _hostMemory.Allocate(desiredAddress, alignedSize, hostProtection);
         }
 
-        if (result == null)
+        if (result == 0)
         {
             if (!allowAlternative)
             {
@@ -153,32 +140,32 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
             }
 
             TraceVmem($"Could not allocate at 0x{desiredAddress:X16}, trying any address...");
-            result = VirtualAlloc(null, (nuint)alignedSize, allocationType, protection);
+            result = _hostMemory.Allocate(0, alignedSize, hostProtection);
 
-            if (result == null)
+            if (result == 0)
             {
                 if (!executable)
                 {
-                    result = VirtualAlloc((void*)desiredAddress, (nuint)alignedSize, MEM_RESERVE, PAGE_READWRITE);
-                    if (result == null && allowAlternative)
+                    result = _hostMemory.Reserve(desiredAddress, alignedSize, HostPageProtection.ReadWrite);
+                    if (result == 0 && allowAlternative)
                     {
-                        result = VirtualAlloc(null, (nuint)alignedSize, MEM_RESERVE, PAGE_READWRITE);
+                        result = _hostMemory.Reserve(0, alignedSize, HostPageProtection.ReadWrite);
                     }
 
-                    if (result != null)
+                    if (result != 0)
                     {
                         reservedOnly = true;
                     }
                 }
 
-                if (result == null)
+                if (result == 0)
                 {
                     throw new OutOfMemoryException($"Failed to allocate {alignedSize} bytes of virtual memory");
                 }
             }
         }
 
-        var actualAddress = (ulong)result;
+        var actualAddress = result;
 
         var lazyPrimeState = "n/a";
         if (reservedOnly)
@@ -191,9 +178,8 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
                 {
                     var remaining = primeBytes - committedBytes;
                     var chunkBytes = Math.Min(remaining, LazyReservePrimeChunkBytes);
-                    var commitAddress = (void*)(actualAddress + committedBytes);
-                    var committed = VirtualAlloc(commitAddress, (nuint)chunkBytes, MEM_COMMIT, PAGE_READWRITE);
-                    if (committed == null)
+                    var commitAddress = actualAddress + committedBytes;
+                    if (!_hostMemory.Commit(commitAddress, chunkBytes, HostPageProtection.ReadWrite))
                     {
                         break;
                     }
@@ -316,7 +302,9 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
                         GuestAllocationArenaSize,
                         executable: false,
                         allowAlternative: true);
-                    _guestAllocationOffset = GuestAllocationArenaStartOffset;
+                    _guestAllocationFreeRanges.Add(
+                        GuestAllocationArenaStartOffset,
+                        GuestAllocationArenaSize - GuestAllocationArenaStartOffset);
                 }
                 catch (Exception)
                 {
@@ -324,18 +312,128 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
                 }
             }
 
-            var alignedOffset = AlignUp(_guestAllocationOffset, alignment);
-            if (alignedOffset > GuestAllocationArenaSize || size > GuestAllocationArenaSize - alignedOffset)
+            ulong rangeOffset = 0;
+            ulong rangeSize = 0;
+            ulong alignedOffset = 0;
+            var found = false;
+            foreach (var range in _guestAllocationFreeRanges)
+            {
+                alignedOffset = AlignUp(range.Key, alignment);
+                if (alignedOffset >= range.Key &&
+                    alignedOffset - range.Key <= range.Value &&
+                    size <= range.Value - (alignedOffset - range.Key))
+                {
+                    rangeOffset = range.Key;
+                    rangeSize = range.Value;
+                    found = true;
+                    break;
+                }
+            }
+
+            if (!found)
             {
                 return false;
             }
 
+            _guestAllocationFreeRanges.Remove(rangeOffset);
+            if (alignedOffset > rangeOffset)
+            {
+                _guestAllocationFreeRanges.Add(rangeOffset, alignedOffset - rangeOffset);
+            }
+
+            var allocationEnd = alignedOffset + size;
+            var rangeEnd = rangeOffset + rangeSize;
+            if (allocationEnd < rangeEnd)
+            {
+                _guestAllocationFreeRanges.Add(allocationEnd, rangeEnd - allocationEnd);
+            }
+
             address = _guestAllocationArenaBase + alignedOffset;
-            _guestAllocationOffset = alignedOffset + size;
+            _guestAllocations.Add(address, (alignedOffset, size));
             return true;
         }
     }
 
+    public bool TryFreeGuestMemory(ulong address)
+    {
+        lock (_guestAllocationGate)
+        {
+            if (!_guestAllocations.Remove(address, out var allocation))
+            {
+                return false;
+            }
+
+            var freeOffset = allocation.Offset;
+            var freeSize = allocation.Size;
+            ulong? previousOffset = null;
+            ulong? nextOffset = null;
+
+            foreach (var range in _guestAllocationFreeRanges)
+            {
+                if (range.Key < freeOffset)
+                {
+                    previousOffset = range.Key;
+                    continue;
+                }
+
+                nextOffset = range.Key;
+                break;
+            }
+
+            if (previousOffset is { } previous &&
+                previous + _guestAllocationFreeRanges[previous] == freeOffset)
+            {
+                freeOffset = previous;
+                freeSize += _guestAllocationFreeRanges[previous];
+                _guestAllocationFreeRanges.Remove(previous);
+            }
+
+            if (nextOffset is { } next && freeOffset + freeSize == next)
+            {
+                freeSize += _guestAllocationFreeRanges[next];
+                _guestAllocationFreeRanges.Remove(next);
+            }
+
+            _guestAllocationFreeRanges.Add(freeOffset, freeSize);
+            return true;
+        }
+    }
+
+    public bool TryProtect(ulong address, ulong size, GuestPageProtection protection)
+    {
+        if (size == 0)
+        {
+            return false;
+        }
+
+        return _hostMemory.Protect(address, size, ResolveProtection(protection), out _);
+    }
+
+    // Reproduces the decomposition KernelMemoryCompatExports.ResolveHostProtection
+    // performed before this seam existed; the Windows backend maps each case back
+    // to the identical PAGE_* value.
+    private static HostPageProtection ResolveProtection(GuestPageProtection protection)
+    {
+        var read = (protection & GuestPageProtection.Read) != 0;
+        var write = (protection & GuestPageProtection.Write) != 0;
+        var execute = (protection & GuestPageProtection.Execute) != 0;
+
+        if (execute)
+        {
+            return write
+                ? HostPageProtection.ReadWriteExecute
+                : read
+                    ? HostPageProtection.ReadExecute
+                    : HostPageProtection.Execute;
+        }
+
+        return write
+            ? HostPageProtection.ReadWrite
+            : read
+                ? HostPageProtection.ReadOnly
+                : HostPageProtection.NoAccess;
+    }
+
     public void Clear()
     {
         lock (_guestAllocationGate)
@@ -345,7 +443,7 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
             {
                 foreach (var region in _regions)
                 {
-                    VirtualFree((void*)region.VirtualAddress, 0, MEM_RELEASE);
+                    _hostMemory.Free(region.VirtualAddress);
                 }
                 _regions.Clear();
                 _pageProtections.Clear();
@@ -360,7 +458,8 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
             }
 
             _guestAllocationArenaBase = 0;
-            _guestAllocationOffset = 0;
+            _guestAllocationFreeRanges.Clear();
+            _guestAllocations.Clear();
         }
     }
 
@@ -419,46 +518,67 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
 
     private void ApplySegmentProtection(ulong mapStart, ulong mapEnd, ProgramHeaderFlags flags)
     {
+        var runStart = mapStart;
+        var runFlags = ProgramHeaderFlags.None;
+        var hasRun = false;
+
         for (var pageAddress = mapStart; pageAddress < mapEnd; pageAddress += PageSize)
         {
             _pageProtections.TryGetValue(pageAddress, out var existingFlags);
             var mergedFlags = existingFlags | flags;
             _pageProtections[pageAddress] = mergedFlags;
-            SetProtection(pageAddress, PageSize, mergedFlags);
+
+            if (!hasRun)
+            {
+                runStart = pageAddress;
+                runFlags = mergedFlags;
+                hasRun = true;
+            }
+            else if (mergedFlags != runFlags)
+            {
+                SetProtection(runStart, pageAddress - runStart, runFlags);
+                runStart = pageAddress;
+                runFlags = mergedFlags;
+            }
+        }
+
+        if (hasRun)
+        {
+            SetProtection(runStart, mapEnd - runStart, runFlags);
         }
     }
 
     private void SetProtection(ulong address, ulong size, ProgramHeaderFlags flags)
     {
-        uint protection;
+        HostPageProtection protection;
 
         if (flags == ProgramHeaderFlags.None)
         {
-            protection = PAGE_NOACCESS;
+            protection = HostPageProtection.NoAccess;
         }
         else if ((flags & ProgramHeaderFlags.Execute) != 0)
         {
             protection = (flags & ProgramHeaderFlags.Write) != 0
-                ? PAGE_EXECUTE_READWRITE
-                : PAGE_EXECUTE_READ;
+                ? HostPageProtection.ReadWriteExecute
+                : HostPageProtection.ReadExecute;
         }
         else if ((flags & ProgramHeaderFlags.Write) != 0)
         {
-            protection = PAGE_READWRITE;
+            protection = HostPageProtection.ReadWrite;
         }
         else
         {
-            protection = PAGE_READONLY;
+            protection = HostPageProtection.ReadOnly;
         }
 
-        if (!VirtualProtect((void*)address, (nuint)size, protection, out _))
+        if (!_hostMemory.Protect(address, size, protection, out _))
         {
             throw new InvalidOperationException($"Failed to set memory protection at 0x{address:X16}");
         }
 
         if ((flags & ProgramHeaderFlags.Execute) != 0)
         {
-            FlushInstructionCache(GetCurrentProcess(), (void*)address, (nuint)size);
+            _hostMemory.FlushInstructionCache(address, size);
         }
     }
 
@@ -550,6 +670,47 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         }
     }
 
+    public bool TryCompare(ulong virtualAddress, ReadOnlySpan<byte> expected)
+    {
+        _gate.EnterReadLock();
+        try
+        {
+            var region = FindRegion(virtualAddress, (ulong)expected.Length);
+            if (region is null ||
+                !TryResolveRegionOffset(
+                    virtualAddress,
+                    (ulong)expected.Length,
+                    region,
+                    out var offset))
+            {
+                return false;
+            }
+
+            if (expected.IsEmpty)
+            {
+                return true;
+            }
+
+            var srcPtr = (void*)(region.VirtualAddress + offset);
+            if (region.IsReservedOnly &&
+                !EnsureRangeCommitted((ulong)srcPtr, (ulong)expected.Length, region))
+            {
+                return false;
+            }
+
+            if (!CanReadWithoutProtectionChange((ulong)srcPtr, (ulong)expected.Length, region))
+            {
+                return false;
+            }
+
+            return new ReadOnlySpan<byte>(srcPtr, expected.Length).SequenceEqual(expected);
+        }
+        finally
+        {
+            _gate.ExitReadLock();
+        }
+    }
+
     public bool TryWrite(ulong virtualAddress, ReadOnlySpan<byte> source)
     {
         var requiresExclusiveAccess = false;
@@ -689,7 +850,7 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
                 return true;
             }
 
-            if (!VirtualProtect(destPtr, (nuint)source.Length, PAGE_EXECUTE_READWRITE, out var oldProtect))
+            if (!_hostMemory.Protect((ulong)destPtr, (ulong)source.Length, HostPageProtection.ReadWriteExecute, out var oldProtect))
             {
                 return false;
             }
@@ -703,10 +864,10 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
             }
             finally
             {
-                VirtualProtect(destPtr, (nuint)source.Length, oldProtect, out _);
+                _hostMemory.ProtectRaw((ulong)destPtr, (ulong)source.Length, oldProtect, out _);
                 if (IsExecutableProtection(oldProtect))
                 {
-                    FlushInstructionCache(GetCurrentProcess(), destPtr, (nuint)source.Length);
+                    _hostMemory.FlushInstructionCache((ulong)destPtr, (ulong)source.Length);
                 }
             }
 
@@ -728,9 +889,14 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         _gate.EnterReadLock();
         try
         {
-            return FindRegion(virtualAddress, 1) is not null
-                ? (void*)virtualAddress
-                : null;
+            var region = FindRegion(virtualAddress, 1);
+            if (region is null ||
+                (region.IsReservedOnly && !EnsureRangeCommitted(virtualAddress, 1, region)))
+            {
+                return null;
+            }
+
+            return (void*)virtualAddress;
         }
         finally
         {
@@ -932,12 +1098,12 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         return protection is PAGE_READWRITE or PAGE_EXECUTE_READWRITE;
     }
 
-    private static uint GetCommitProtection(MemoryRegion region)
+    private static HostPageProtection GetCommitProtection(MemoryRegion region)
     {
-        return region.IsExecutable ? PAGE_EXECUTE_READWRITE : PAGE_READWRITE;
+        return region.IsExecutable ? HostPageProtection.ReadWriteExecute : HostPageProtection.ReadWrite;
     }
 
-    private static unsafe bool EnsureRangeCommitted(ulong address, ulong size, MemoryRegion region)
+    private bool EnsureRangeCommitted(ulong address, ulong size, MemoryRegion region)
     {
         if (size == 0 || !region.IsReservedOnly)
         {
@@ -951,7 +1117,7 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         var pageAddress = startPage;
         while (pageAddress < endPage)
         {
-            if (VirtualQuery((void*)pageAddress, out var info, (nuint)sizeof(MemoryBasicInformation64)) == 0)
+            if (!_hostMemory.Query(pageAddress, out var info))
             {
                 return false;
             }
@@ -965,19 +1131,19 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
                 return false;
             }
 
-            if (info.State == MEM_COMMIT)
+            if (info.State == HostRegionState.Committed)
             {
                 pageAddress = rangeEnd;
                 continue;
             }
 
-            if (info.State != MEM_RESERVE)
+            if (info.State != HostRegionState.Reserved)
             {
                 return false;
             }
 
             var commitSize = rangeEnd - pageAddress;
-            if (VirtualAlloc((void*)pageAddress, (nuint)commitSize, MEM_COMMIT, commitProtection) == null)
+            if (!_hostMemory.Commit(pageAddress, commitSize, commitProtection))
             {
                 return false;
             }
@@ -998,11 +1164,11 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
 
         var startPage = AlignDown(address, PageSize);
         var endPage = AlignUp(address + size, PageSize);
-        var temporaryProtection = region.IsExecutable ? PAGE_EXECUTE_READWRITE : PAGE_READWRITE;
+        var temporaryProtection = region.IsExecutable ? HostPageProtection.ReadWriteExecute : HostPageProtection.ReadWrite;
 
         for (var pageAddress = startPage; pageAddress < endPage; pageAddress += PageSize)
         {
-            if (!VirtualProtect((void*)pageAddress, (nuint)PageSize, temporaryProtection, out var oldProtection))
+            if (!_hostMemory.Protect(pageAddress, PageSize, temporaryProtection, out var oldProtection))
             {
                 RestorePageProtections(touchedPages);
                 touchedPages.Clear();
@@ -1015,11 +1181,11 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         return true;
     }
 
-    private static void RestorePageProtections(List<(ulong Address, uint Protection)> touchedPages)
+    private void RestorePageProtections(List<(ulong Address, uint Protection)> touchedPages)
     {
         foreach (var (pageAddress, protection) in touchedPages)
         {
-            VirtualProtect((void*)pageAddress, (nuint)PageSize, protection, out _);
+            _hostMemory.ProtectRaw(pageAddress, PageSize, protection, out _);
         }
     }
 
@@ -1076,16 +1242,4 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         public uint Protection { get; set; }
     }
 
-    private struct MemoryBasicInformation64
-    {
-        public ulong BaseAddress;
-        public ulong AllocationBase;
-        public uint AllocationProtect;
-        public uint Alignment1;
-        public ulong RegionSize;
-        public uint State;
-        public uint Protect;
-        public uint Type;
-        public uint Alignment2;
-    }
 }

src/SharpEmu.Core/Memory/VirtualMemory.cs

@@ -41,15 +41,14 @@ public sealed class VirtualMemory : IVirtualMemory
 
         lock (_gate)
         {
-            foreach (var existing in _regions)
+            var insertionIndex = FindInsertionIndex(virtualAddress);
+            if ((insertionIndex > 0 && virtualAddress < _regions[insertionIndex - 1].EndAddress) ||
+                (insertionIndex < _regions.Count && endAddress > _regions[insertionIndex].Region.VirtualAddress))
             {
-                if (virtualAddress < existing.EndAddress && endAddress > existing.Region.VirtualAddress)
-                {
-                    throw new InvalidOperationException("Attempted to map an overlapping virtual memory region.");
-                }
+                throw new InvalidOperationException("Attempted to map an overlapping virtual memory region.");
             }
 
-            _regions.Add(new MappedRegion(
+            _regions.Insert(insertionIndex, new MappedRegion(
                 new VirtualMemoryRegion(virtualAddress, memorySize, fileOffset, (ulong)fileData.Length, protection),
                 endAddress,
                 backingMemory));
@@ -74,12 +73,12 @@ public sealed class VirtualMemory : IVirtualMemory
     {
         lock (_gate)
         {
-            if (!TryResolveRegion(virtualAddress, destination.Length, out var region, out var offset))
+            if (!TryValidateRange(virtualAddress, destination.Length, ProgramHeaderFlags.Read, out var regionIndex))
             {
                 return false;
             }
 
-            region.BackingMemory.AsSpan(offset, destination.Length).CopyTo(destination);
+            CopyFromRegions(virtualAddress, destination, regionIndex);
             return true;
         }
     }
@@ -88,39 +87,127 @@ public sealed class VirtualMemory : IVirtualMemory
     {
         lock (_gate)
         {
-            if (!TryResolveRegion(virtualAddress, source.Length, out var region, out var offset))
+            if (!TryValidateRange(virtualAddress, source.Length, ProgramHeaderFlags.Write, out var regionIndex))
             {
                 return false;
             }
 
-            source.CopyTo(region.BackingMemory.AsSpan(offset, source.Length));
+            CopyToRegions(virtualAddress, source, regionIndex);
             return true;
         }
     }
 
-    private bool TryResolveRegion(ulong virtualAddress, int length, out MappedRegion region, out int offset)
+    private bool TryValidateRange(
+        ulong virtualAddress,
+        int length,
+        ProgramHeaderFlags requiredProtection,
+        out int regionIndex)
     {
-        foreach (var candidate in _regions)
+        regionIndex = FindContainingRegionIndex(virtualAddress);
+        if (regionIndex < 0)
         {
-            if (virtualAddress < candidate.Region.VirtualAddress || virtualAddress >= candidate.EndAddress)
-            {
-                continue;
-            }
-
-            var candidateOffset = checked((int)(virtualAddress - candidate.Region.VirtualAddress));
-            if (candidateOffset + length > candidate.BackingMemory.Length)
-            {
-                break;
-            }
-
-            region = candidate;
-            offset = candidateOffset;
-            return true;
+            return false;
         }
 
-        region = default;
-        offset = 0;
-        return false;
+        var currentAddress = virtualAddress;
+        var remaining = length;
+        var currentIndex = regionIndex;
+        while (true)
+        {
+            if (currentIndex >= _regions.Count)
+            {
+                return false;
+            }
+
+            var region = _regions[currentIndex];
+            if (currentAddress < region.Region.VirtualAddress ||
+                currentAddress >= region.EndAddress ||
+                (region.Region.Protection & requiredProtection) == 0)
+            {
+                return false;
+            }
+
+            if (remaining == 0)
+            {
+                return true;
+            }
+
+            var available = region.EndAddress - currentAddress;
+            var chunkLength = (int)Math.Min((ulong)remaining, available);
+            remaining -= chunkLength;
+            if (remaining == 0)
+            {
+                return true;
+            }
+
+            currentAddress += (ulong)chunkLength;
+            currentIndex++;
+        }
+    }
+
+    private int FindContainingRegionIndex(ulong virtualAddress)
+    {
+        var insertionIndex = FindInsertionIndex(virtualAddress);
+        if (insertionIndex < _regions.Count &&
+            _regions[insertionIndex].Region.VirtualAddress == virtualAddress)
+        {
+            return insertionIndex;
+        }
+
+        var candidateIndex = insertionIndex - 1;
+        return candidateIndex >= 0 && virtualAddress < _regions[candidateIndex].EndAddress
+            ? candidateIndex
+            : -1;
+    }
+
+    private void CopyFromRegions(ulong virtualAddress, Span<byte> destination, int regionIndex)
+    {
+        var copied = 0;
+        var currentAddress = virtualAddress;
+        while (copied < destination.Length)
+        {
+            var region = _regions[regionIndex++];
+            var regionOffset = checked((int)(currentAddress - region.Region.VirtualAddress));
+            var chunkLength = Math.Min(destination.Length - copied, region.BackingMemory.Length - regionOffset);
+            region.BackingMemory.AsSpan(regionOffset, chunkLength).CopyTo(destination[copied..]);
+            copied += chunkLength;
+            currentAddress += (ulong)chunkLength;
+        }
+    }
+
+    private void CopyToRegions(ulong virtualAddress, ReadOnlySpan<byte> source, int regionIndex)
+    {
+        var copied = 0;
+        var currentAddress = virtualAddress;
+        while (copied < source.Length)
+        {
+            var region = _regions[regionIndex++];
+            var regionOffset = checked((int)(currentAddress - region.Region.VirtualAddress));
+            var chunkLength = Math.Min(source.Length - copied, region.BackingMemory.Length - regionOffset);
+            source.Slice(copied, chunkLength).CopyTo(region.BackingMemory.AsSpan(regionOffset, chunkLength));
+            copied += chunkLength;
+            currentAddress += (ulong)chunkLength;
+        }
+    }
+
+    private int FindInsertionIndex(ulong virtualAddress)
+    {
+        var lower = 0;
+        var upper = _regions.Count;
+        while (lower < upper)
+        {
+            var middle = lower + ((upper - lower) / 2);
+            if (_regions[middle].Region.VirtualAddress < virtualAddress)
+            {
+                lower = middle + 1;
+            }
+            else
+            {
+                upper = middle;
+            }
+        }
+
+        return lower;
     }
 
     private readonly record struct MappedRegion(VirtualMemoryRegion Region, ulong EndAddress, byte[] BackingMemory);

src/SharpEmu.Core/Runtime/SharpEmuRuntime.cs

@@ -7,6 +7,7 @@ using SharpEmu.Core.Cpu.Disasm;
 using SharpEmu.Core.Loader;
 using SharpEmu.Core.Memory;
 using SharpEmu.HLE;
+using SharpEmu.HLE.Host;
 using SharpEmu.Libs.VideoOut;
 using SharpEmu.Libs.Kernel;
 using SharpEmu.Libs.AppContent;
@@ -86,14 +87,19 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
         moduleManager.RegisterFromAssembly(typeof(KernelExports).Assembly, Generation.Gen4 | Generation.Gen5, Aerolib.Instance);
         moduleManager.Freeze();
 
-        var virtualMemory = new PhysicalVirtualMemory();
+        // Resolve the host platform once at the composition root; on unsupported
+        // OSes this throws PlatformNotSupportedException with a clear message
+        // instead of failing on the first native call.
+        var hostPlatform = HostPlatform.Current;
+
+        var virtualMemory = new PhysicalVirtualMemory(hostPlatform.Memory);
 
         var fileSystem = new PhysicalFileSystem();
 
         return new SharpEmuRuntime(
             new SelfLoader(),
             virtualMemory,
-            new CpuDispatcher(virtualMemory, moduleManager),
+            new CpuDispatcher(virtualMemory, moduleManager, hostPlatform: hostPlatform),
             moduleManager,
             Aerolib.Instance,
             cpuExecutionOptions,

src/SharpEmu.GUI/GuiSettings.cs

@@ -48,6 +48,9 @@ public sealed class GuiSettings
     /// <summary>Publish launcher/game status to Discord Rich Presence.</summary>
     public bool DiscordRichPresence { get; set; } = true;
 
+    /// <summary>Names of SHARPEMU_* switches set to "1" in the emulator's environment at launch.</summary>
+    public List<string> EnvironmentToggles { get; set; } = new();
+
     /// <summary>
     /// Discord application ID used for Rich Presence; the default is the
     /// SharpEmu application. Override to rebrand what Discord shows as

src/SharpEmu.GUI/Languages/br.json

@@ -0,0 +1,138 @@
+{
+  "_languageName": "Português (Brasil)",
+
+  "Page.Library": "Biblioteca",
+  "Page.Options": "Opções",
+  "Page.GameCount.One": "1 Jogo",
+  "Page.GameCount.Other": "{0} jogos",
+
+  "Library.SearchWatermark": "Pesquisar na biblioteca…",
+  "Library.AddFolder": "＋ Adicionar pasta",
+  "Library.Rescan": "⟳ Atualizar biblioteca",
+  "Library.OpenFile": "Abrir arquivo…",
+
+  "Library.Context.Launch": "Jogar",
+  "Library.Context.OpenFolder": "Abrir pasta do jogo",
+  "Library.Context.CopyPath": "Copiar o caminho",
+  "Library.Context.CopyTitleId": "Copiar ID do título",
+  "Library.Context.Remove": "Remover da biblioteca",
+
+  "Library.Empty.Title": "Sua biblioteca está vazia",
+  "Library.Empty.Hint": "Adicione uma pasta contendo seus jogos para começar.",
+  "Library.Empty.SearchTitle": "Nenhum jogo corresponde à sua busca",
+  "Library.Empty.SearchHint": "Nada na biblioteca corresponde a “{0}”.",
+  "Library.Empty.AddFolder": "＋ Adicionar pasta do jogo",
+
+  "Library.Loading": "Carregando biblioteca…",
+
+  "Options.General": "Opções Gerais",
+  "Options.Env.Tab": "Ambiente",
+  "Options.Section.Environment": "VARIÁVEIS DE AMBIENTE",
+  "Options.Env.Desc": "Switches passados para o emulador como variáveis de ambiente na inicialização.",
+  "Options.Env.Bthid.Desc": "Reporta o Bluetooth HID como indisponível para títulos cujo middleware de volante/FFB fica esperando indefinidamente.\nDeixe desativado normalmente. Alguns títulos travam quando a inicialização falha.",
+  "Options.Env.LoopGuard.Desc": "Não force o encerramento de títulos que repetem a mesma chamada por tempo demais.\nExperimente isso quando um jogo fecha sozinho durante o carregamento.",
+  "Options.Env.VkValidation.Desc": "Ativa as camadas de validação do Vulkan para depuração de GPU.\nLento. Requer que o Vulkan SDK esteja instalado.",
+  "Options.Env.DumpSpirv.Desc": "Extrai os shaders AGC e suas traduções SPIR-V para a pasta shader-dumps.\nUse ao reportar bugs de shader ou renderização.",
+  "Options.Env.LogDirectMemory.Desc": "Registra alocações de memória direta e falhas no console.\nUse quando um jogo aborta ou fecha durante a inicialização (boot).",
+  "Options.Env.LogNp.Desc": "Registra chamadas da biblioteca NP (PlayStation Network) no console.",
+  "Options.Section.Emulation": "EMULAÇÃO",
+  "Options.Section.Logging": "LOGS",
+  "Options.Section.Launcher": "INICIALIZADOR",
+
+  "Options.CpuEngine.Label": "Motor da CPU",
+  "Options.CpuEngine.Desc": "Motor de execução usado para executar o código do jogo.",
+  "Options.CpuEngine.Native": "Nativo",
+
+  "Options.Strict.Label": "Resolução estrita de bibliotecas dinâmicas",
+  "Options.Strict.Desc": "Interrompe a inicialização caso um símbolo importado não possa ser vinculado.",
+
+  "Options.LogLevel.Label": "Nível de log",
+  "Options.LogLevel.Desc": "Nível de detalhamento das mensagens exibidas no console do emulador.",
+  "Options.LogLevel.Trace": "Trace",
+  "Options.LogLevel.Debug": "Debug",
+  "Options.LogLevel.Info": "Info",
+  "Options.LogLevel.Warning": "Warning",
+  "Options.LogLevel.Error": "Error",
+  "Options.LogLevel.Critical": "Critical",
+
+  "Options.TraceImports.Label": "Limite de rastreamento de importações",
+  "Options.TraceImports.Desc": "Rastreia as primeiras N importações de cada módulo (0 = desativado).",
+
+  "Options.LogToFile.Label": "Salvar log em arquivo",
+  "Options.LogToFile.Desc": "Copia a saída do emulador para um arquivo de log.",
+
+  "Options.LogFilePath.Label": "Caminho do arquivo de log",
+  "Options.LogFilePath.Default": "Nenhum caminho definido — logs vão para user/logs na pasta do emulador.",
+  "Options.LogFilePath.Select": "Selecionar…",
+
+  "Options.OverrideLogFile.Label": "Sobrescrever arquivo de log",
+  "Options.OverrideLogFile.Desc": "Use o caminho exato do arquivo em vez de adicionar o ID do título e o log de data e hora.",
+
+  "Options.TitleMusic.Label": "Música de prévia",
+  "Options.TitleMusic.Desc": "Reproduz em loop a música de prévia do jogo selecionado na biblioteca.",
+
+  "Options.Discord.Label": "Status do Discord",
+  "Options.Discord.Desc": "Exibir o jogo em execução no seu perfil do Discord.",
+
+  "Options.Language.Label": "Idioma do emulador",
+  "Options.Language.Desc": "Idioma usado em toda a interface do emulador. A alteração é aplicada imediatamente.",
+
+  "Common.On": "Ativado",
+  "Common.Off": "Desativado",
+
+  "Console.Title": "CONSOLE",
+  "Console.SearchWatermark": "Pesquisar...",
+  "Console.AutoScroll": "Rolagem automática",
+  "Console.Split": "Recortar",
+  "Console.Copy": "Copiar",
+  "Console.Clear": "Limpar",
+  "Console.WindowTitle": "Console do SharpEmu",
+
+  "Launch.NoGameSelected": "Nenhum jogo selecionado",
+  "Launch.NoGameHint": "Selecione um jogo na biblioteca ou abra um arquivo eboot.bin diretamente.",
+  "Launch.Idle": "Ocioso",
+  "Launch.Console": "≡ Console",
+  "Launch.Launch": "▶  Iniciar",
+  "Launch.Stop": "■  Parar",
+  "Launch.Running": "Em execução — {0}",
+  "Launch.Stopping": "Encerrando…",
+  "Launch.Exited": "Encerrado com código {0} ({1})",
+  "Launch.ExeNotFound": "Executável do SharpEmu não encontrado. Compile primeiro o projeto SharpEmu.CLI (dotnet build).",
+  "Launch.LogFile": "Arquivo de log: {0}",
+  "Launch.Command": "$ SharpEmu {0}",
+  "Launch.StartFailed": "Falha ao iniciar o emulador: {0}",
+  "Launch.ProcessExited": "O processo foi encerrado com código {0} ({1}).",
+
+  "Exit.Ok": "OK",
+  "Exit.InvalidArguments": "argumentos inválidos",
+  "Exit.EbootNotFound": "eboot.bin não encontrado",
+  "Exit.RuntimeException": "exceção em tempo de execução",
+  "Exit.EmulationError": "erro de emulação",
+  "Exit.Unknown": "desconhecido",
+
+  "Status.EmulatorLocating": "Emulador: localizando…",
+  "Status.EmulatorPath": "Emulador: {0}",
+  "Status.EmulatorNotFound": "Emulador: executável do SharpEmu não encontrado — compile o SharpEmu.CLI primeiro.",
+  "Status.ScanningLibrary": "Verificando biblioteca…",
+  "Status.AddFolderPrompt": "Adicione uma pasta de jogos para preencher a biblioteca.",
+  "Status.LibraryScanned": "Biblioteca verificada: {0} jogo(s) em {1} pasta(s).",
+  "Status.CouldNotOpenFolder": "Não foi possível abrir a pasta: {0}",
+  "Status.CopiedToClipboard": "{0} copiado para a área de transferência.",
+  "Status.RemovedFromLibrary": "“{0}” removido da biblioteca. Adicione novamente sua pasta para restaurá-lo.",
+  "Status.Running": "Executando {0}",
+  "Status.Stopping": "Encerrando…",
+  "Status.Idle": "Ocioso",
+
+  "Clipboard.Path": "Caminho",
+  "Clipboard.TitleId": "ID do título",
+
+  "Discord.Playing": "Jogando {0}",
+  "Discord.Browsing": "Navegando pela biblioteca",
+
+  "Dialog.ChooseGameFolder": "Escolha uma pasta contendo jogos",
+  "Dialog.OpenExecutable": "Abrir um executável para iniciar",
+  "Dialog.PsExecutables": "Executáveis de PS",
+  "Dialog.SaveLogFile": "Selecione onde salvar o arquivo de log",
+  "Dialog.PlainTextFiles": "Arquivos de texto simples",
+  "Dialog.LogFiles": "Arquivos de log"
+}

src/SharpEmu.GUI/Languages/de.json

@@ -20,7 +20,7 @@
   "Library.Empty.Title": "Deine Bibliothek ist leer",
   "Library.Empty.Hint": "Füge einen Ordner mit deinen Spielen hinzu, um zu beginnen.",
   "Library.Empty.SearchTitle": "Keine Spiele gefunden",
-  "Library.Empty.SearchHint": "Nichts in der Bibliothek entspricht "{0}".",
+  "Library.Empty.SearchHint": "Nichts in der Bibliothek entspricht “{0}”.",
   "Library.Empty.AddFolder": "＋ Spielordner hinzufügen",
 
   "Library.Loading": "Bibliothek wird geladen…",
@@ -109,7 +109,7 @@
   "Status.LibraryScanned": "Bibliothek gescannt: {0} Spiel(e) in {1} Ordner(n).",
   "Status.CouldNotOpenFolder": "Ordner konnte nicht geöffnet werden: {0}",
   "Status.CopiedToClipboard": "{0} in die Zwischenablage kopiert.",
-  "Status.RemovedFromLibrary": ""{0}" wurde aus der Bibliothek entfernt. Füge den Ordner erneut hinzu, um es wiederherzustellen.",
+  "Status.RemovedFromLibrary": "“{0}” wurde aus der Bibliothek entfernt. Füge den Ordner erneut hinzu, um es wiederherzustellen.",
   "Status.Running": "Läuft {0}",
   "Status.Stopping": "Wird gestoppt…",
   "Status.Idle": "Bereit",

src/SharpEmu.GUI/Languages/en.json

@@ -26,6 +26,15 @@
   "Library.Loading": "Loading library…",
 
   "Options.General": "General",
+  "Options.Env.Tab": "Environment",
+  "Options.Section.Environment": "ENVIRONMENT VARIABLES",
+  "Options.Env.Desc": "Switches passed to the emulator as environment variables at launch.",
+  "Options.Env.Bthid.Desc": "Report Bluetooth HID as unavailable for titles whose wheel/FFB middleware polls forever.\nLeave off normally. Some titles freeze when init fails.",
+  "Options.Env.LoopGuard.Desc": "Do not force quit titles that repeat the same call for too long.\nTry this when a game exits on its own while loading.",
+  "Options.Env.VkValidation.Desc": "Enable Vulkan validation layers for GPU debugging.\nSlow. Requires the Vulkan SDK to be installed.",
+  "Options.Env.DumpSpirv.Desc": "Dump AGC shaders and their SPIR-V translations to the shader-dumps folder.\nUse when reporting shader or rendering bugs.",
+  "Options.Env.LogDirectMemory.Desc": "Log direct memory allocations and failures to the console.\nUse when a game aborts or exits during boot.",
+  "Options.Env.LogNp.Desc": "Log NP (PlayStation Network) library calls to the console.",
   "Options.Section.Emulation": "EMULATION",
   "Options.Section.Logging": "LOGGING",
   "Options.Section.Launcher": "LAUNCHER",
@@ -125,5 +134,13 @@
   "Dialog.PsExecutables": "PS executables",
   "Dialog.SaveLogFile": "Select where to save the Log file",
   "Dialog.PlainTextFiles": "Plain Text Files",
-  "Dialog.LogFiles": "Log Files"
+  "Dialog.LogFiles": "Log Files",
+
+  "Options.About" : "About",
+  "About.Github.Label": "GitHub",
+  "About.Github.Desc": "Source code, issues and project development.",
+  "About.Discord.Label": "Discord",
+  "About.Discord.Desc": "Join the community, get support and follow development.",
+  "About.GithubButton": "Contribute in GitHub!",
+  "About.DiscordButton": "Join our Discord!"
 }

src/SharpEmu.GUI/Languages/es.json

@@ -125,5 +125,13 @@
   "Dialog.PsExecutables": "Ejecutables de PS",
   "Dialog.SaveLogFile": "Selecciona dónde guardar el archivo de Logs",
   "Dialog.PlainTextFiles": "Archivos en texto plano",
-  "Dialog.LogFiles": "Archivos de Log"
+  "Dialog.LogFiles": "Archivos de Log",
+
+  "Options.About" : "Informacion",
+  "About.Github.Label": "GitHub",
+  "About.Github.Desc": "Código fuente, issues y desarrollo del proyecto.",
+  "About.Discord.Label": "Discord",
+  "About.Discord.Desc": "Únete a la comunidad, recibe soporte y sigue el desarrollo.",
+  "About.GithubButton": "Contribuye en GitHub!",
+  "About.DiscordButton": "Únete a nuestro Discord!"
 }

src/SharpEmu.GUI/Languages/hu.json

@@ -0,0 +1,146 @@
+{
+  "_languageName": "Hungarian",
+
+  "Page.Library": "Könyvtár",
+  "Page.Options": "Beállítások",
+  "Page.GameCount.One": "1 játék",
+  "Page.GameCount.Other": "{0} játékok",
+
+  "Library.SearchWatermark": "Keresés a könyvtárban",
+  "Library.AddFolder": "＋ Mappa hozzáadása",
+  "Library.Rescan": "⟳ Újrakeresés",
+  "Library.OpenFile": "Fájl megnyitása…",
+
+  "Library.Context.Launch": "Inditás",
+  "Library.Context.OpenFolder": "Játékmappa megnyitása",
+  "Library.Context.CopyPath": "Elérési út másolása",
+  "Library.Context.CopyTitleId": "Cím ID másolása",
+  "Library.Context.Remove": "Eltávolítás a Könyvtárból",
+
+  "Library.Empty.Title": "A könyvtárad üres",
+  "Library.Empty.Hint": "Add meg a játékaidat tartalmazó mappát a kezdáshez.",
+  "Library.Empty.SearchTitle": "Nincs találat a elemre",
+  "Library.Empty.SearchHint": "A könyvtárban nincs olyan elem, amely egyezne a „{0}” kifejezéssel.",
+  "Library.Empty.AddFolder": "＋ Játékmappa hozzáadása",
+
+  "Library.Loading": "Könyvtár betöltése",
+
+  "Options.General": "Általános",
+  "Options.Env.Tab": "Környezet",
+  "Options.Section.Environment": "KÖRNYEZETI VÁLTOZÓK",
+  "Options.Env.Desc": "Indításkor környezeti változóként az emulátorhoz átadott kapcsolók.",
+  "Options.Env.Bthid.Desc": "Jelenti, amely címeknél a Bluetooth HID nem elérhető, amelyeknél a kormány/FFB-közbenső szoftver végtelenül lekérdezi az adatokat.\nNormál esetben hagyja ki. Egyes címek lefagyanak, ha az inicializálás sikertelen.",
+  "Options.Env.LoopGuard.Desc": "Ne erőltesse a kilépést azoknál a címeknél, amelyek túl sokáig ismételnek ugyanazt a hívást.\nPróbálja ki ezt, ha egy játék betöltés közben magától kilép.",
+  "Options.Env.VkValidation.Desc": "Engedélyezze a Vulkan-érvényesítési rétegeket a GPU hibakereséshez.\nLassú. A Vulkan SDK telepítését igényli.",
+  "Options.Env.DumpSpirv.Desc": "Az AGC-shaderek és azok SPIR-V-fordításainak mentése a shader-dumps mappába.\nHasználd shader- vagy renderelési hibák jelentésekor.",
+  "Options.Env.LogDirectMemory.Desc": "A közvetlen memóriaallokációk és hibák naplózása a konzolra.\nHasználd, ha egy játék a rendszerindítás során megszakad vagy kilép.",
+  "Options.Env.LogNp.Desc": "Az NP (PlayStation Network) könyvtárhívásokat naplózza a konzolra.",
+  "Options.Section.Emulation": "EMULÁCIÓ",
+  "Options.Section.Logging": "LOGOLÁS",
+  "Options.Section.Launcher": "INDITÓ",
+
+  "Options.CpuEngine.Label": "CPU motor",
+  "Options.CpuEngine.Desc": "A játék kódjának futtatásához használt végrehajtó motor.",
+  "Options.CpuEngine.Native": "Natív",
+
+  "Options.Strict.Label": "Szigorú dynlib felbontás",
+  "Options.Strict.Desc": "Indítás megszakítása, ha egy importált szimbólum nem oldható fel.",
+
+  "Options.LogLevel.Label": "Naplózási szint",
+  "Options.LogLevel.Desc": "Az emulátor konzol kimenetének részletessége.",
+  "Options.LogLevel.Trace": "Trace",
+  "Options.LogLevel.Debug": "Debug",
+  "Options.LogLevel.Info": "Információ",
+  "Options.LogLevel.Warning": "Figyelmeztetés",
+  "Options.LogLevel.Error": "Hiba",
+  "Options.LogLevel.Critical": "Kritikus",
+
+  "Options.TraceImports.Label": "Import trace limit",
+  "Options.TraceImports.Desc": "Az első N darab import nyomon követése modulonként (0 = ki).",
+
+  "Options.LogToFile.Label": "Naplozás fájlba",
+  "Options.LogToFile.Desc": "Az emulátor kimenetének tükrözése egy log fájlba.",
+
+  "Options.LogFilePath.Label": "Naplófájl elérési útja",
+  "Options.LogFilePath.Default": "Nincs egyéni út — a logok az emulátor melletti user/logs mappába kerülnek.",
+  "Options.LogFilePath.Select": "Kiválasztás…",
+
+  "Options.OverrideLogFile.Label": "Naplófájl felülírása",
+  "Options.OverrideLogFile.Desc": "A pontos fájlútvonal használata a cím ID és időbélyeg hozzáfűzése helyett.",
+
+  "Options.TitleMusic.Label": "Címzene",
+  "Options.TitleMusic.Desc": "A kiválasztott játék előnézeti zenéjének ismétlése a könyvtárban.",
+
+  "Options.Discord.Label": "Discord jelenlét",
+  "Options.Discord.Desc": "A futó játék megjelenítése a Discord profilodon.",
+
+  "Options.Language.Label": "Emulátor nyelve",
+  "Options.Language.Desc": "Az indítóban használt nyelv. Azonnal érvénybe lép.",
+
+  "Common.On": "Be",
+  "Common.Off": "Ki",
+
+  "Console.Title": "KONZOL",
+  "Console.SearchWatermark": "Keresés...",
+  "Console.AutoScroll": "Automatikus görgetés",
+  "Console.Split": "Felosztás",
+  "Console.Copy": "Másolás",
+  "Console.Clear": "Törlés",
+  "Console.WindowTitle": "SharpEmu Konzol",
+
+  "Launch.NoGameSelected": "Nincs játék kiválasztva",
+  "Launch.NoGameHint": "Válassz egy játékot a könyvtárból, vagy nyiss meg közvetlenül egy eboot.bin fájlt.",
+  "Launch.Idle": "Tétlen",
+  "Launch.Console": "≡ Konzol",
+  "Launch.Launch": "▶  Inditás",
+  "Launch.Stop": "■  Leállítás",
+  "Launch.Running": "Fut — {0}",
+  "Launch.Stopping": "Leállítás…",
+  "Launch.Exited": "Kilépett a következő kóddal: {0} ({1})",
+  "Launch.ExeNotFound": "A SharpEmu futtatható fájl nem található. Előbb építsd fel a SharpEmu.CLI projektet (dotnet build).",
+  "Launch.LogFile": "Naplófájl: {0}",
+  "Launch.Command": "$ SharpEmu {0}",
+  "Launch.StartFailed": "Nem sikerült elindítani az emulátort: {0}",
+  "Launch.ProcessExited": "A folyamat kilépett a következő kóddal: {0} ({1}).",
+
+  "Exit.Ok": "OK",
+  "Exit.InvalidArguments": "nemérvényes argumentumok",
+  "Exit.EbootNotFound": "eboot nem található",
+  "Exit.RuntimeException": "runtime exception",
+  "Exit.EmulationError": "emulációs hiba",
+  "Exit.Unknown": "ismeretlen",
+
+  "Status.EmulatorLocating": "Emulátor: keresés…",
+  "Status.EmulatorPath": "Emulátor: {0}",
+  "Status.EmulatorNotFound": "Emulátor: a SharpEmu futtatható fájl nem található — előbb építsd fel a SharpEmu.CLI-t.",
+  "Status.ScanningLibrary": "Könyvtár beolvasása…",
+  "Status.AddFolderPrompt": "Adj hozzá egy játékmappát a könyvtár feltöltéséhez.",
+  "Status.LibraryScanned": "Könyvtár beolvasva: {0} játék {1} mappában.",
+  "Status.CouldNotOpenFolder": "Nem sikerült megnyitni a mappát: {0}",
+  "Status.CopiedToClipboard": "{0} másolva a vágólapra.",
+  "Status.RemovedFromLibrary": "„{0}” eltávolítva a könyvtárból. A visszaállításához add hozzá újra a mappáját.",
+  "Status.Running": "Fut {0}",
+  "Status.Stopping": "Leállítás…",
+  "Status.Idle": "Nyugodt",
+
+  "Clipboard.Path": "Út",
+  "Clipboard.TitleId": "Cím ID",
+
+  "Discord.Playing": "Játékban {0}",
+  "Discord.Browsing": "Böngéssz a könyvtárban",
+
+  "Dialog.ChooseGameFolder": "Válassz egy mappát ami a játékaidat tartalmazza",
+  "Dialog.OpenExecutable": "Futtatható fájl megnyitása az indításhoz",
+  "Dialog.PsExecutables": "PS futtatható fájlok",
+  "Dialog.SaveLogFile": "Válaszd ki, hogy hova szeretnéd menteni a napló fájlokat",
+  "Dialog.PlainTextFiles": "Egyszerű szöveges fájlok",
+  "Dialog.LogFiles": "Naplózási fájlok",
+
+  "Options.About" : "Erről",
+  "About.Github.Label": "GitHub",
+  "About.Github.Desc": "Forrás kód, hibajelentések és a projekt fejlesztése.",
+  "About.Discord.Label": "Discord",
+  "About.Discord.Desc": "Csatlakozz a közösséghe, kérj segítéget és kövesd nyomon a fejlesztést.",
+  "About.GithubButton": "Járulj hozzá GitHubon!",
+  "About.DiscordButton": "Csatlakozz a Discordunhoz!"
+}

src/SharpEmu.GUI/Languages/ja.json

@@ -0,0 +1,129 @@
+{
+  "_languageName": "日本語",
+
+  "Page.Library": "ライブラリ",
+  "Page.Options": "オプション",
+  "Page.GameCount.One": "ゲーム 1本",
+  "Page.GameCount.Other": "ゲーム {0}本",
+
+  "Library.SearchWatermark": "ライブラリを検索…",
+  "Library.AddFolder": "＋ フォルダーを追加",
+  "Library.Rescan": "⟳ 再スキャン",
+  "Library.OpenFile": "ファイルを開く…",
+
+  "Library.Context.Launch": "起動",
+  "Library.Context.OpenFolder": "ゲームフォルダーを開く",
+  "Library.Context.CopyPath": "パスをコピー",
+  "Library.Context.CopyTitleId": "ゲームIDをコピー",
+  "Library.Context.Remove": "ライブラリから削除",
+
+  "Library.Empty.Title": "ライブラリが空です",
+  "Library.Empty.Hint": "開始するには、ゲームが含まれるフォルダーを追加してください。",
+  "Library.Empty.SearchTitle": "検索条件に一致するゲームが見つかりません",
+  "Library.Empty.SearchHint": "ライブラリに「{0}」と一致する項目はありません。",
+  "Library.Empty.AddFolder": "＋ ゲームフォルダーを追加",
+
+  "Library.Loading": "ライブラリを読み込み中…",
+
+  "Options.General": "一般",
+  "Options.Section.Emulation": "エミュレーション",
+  "Options.Section.Logging": "ロギング",
+  "Options.Section.Launcher": "ランチャー",
+
+  "Options.CpuEngine.Label": "CPUエンジン",
+  "Options.CpuEngine.Desc": "ゲームコードを実行するために使用される実行エンジン。",
+  "Options.CpuEngine.Native": "ネイティブ",
+
+  "Options.Strict.Label": "厳格な動的ライブラリ解決",
+  "Options.Strict.Desc": "インポートされたシンボルが解決できない場合、起動を中断します。",
+
+  "Options.LogLevel.Label": "ログレベル",
+  "Options.LogLevel.Desc": "エミュレータコンソールに表示されるメッセージの詳細度。",
+  "Options.LogLevel.Trace": "トレース",
+  "Options.LogLevel.Debug": "デバッグ",
+  "Options.LogLevel.Info": "情報",
+  "Options.LogLevel.Warning": "警告",
+  "Options.LogLevel.Error": "エラー",
+  "Options.LogLevel.Critical": "致命的なエラー",
+
+  "Options.TraceImports.Label": "インポートトレース制限",
+  "Options.TraceImports.Desc": "各モジュールの最初のN個のインポートをトレースします（0 = 無効）。",
+
+  "Options.LogToFile.Label": "ファイルに保存",
+  "Options.LogToFile.Desc": "エミュレータの出力をログファイルにコピーします。",
+
+  "Options.LogFilePath.Label": "ログファイルのパス",
+  "Options.LogFilePath.Default": "カスタムパスなし — ログはエミュレータと同じ場所の user/logs フォルダーに保存されます。",
+  "Options.LogFilePath.Select": "選択…",
+
+  "Options.OverrideLogFile.Label": "ログファイルを上書き",
+  "Options.OverrideLogFile.Desc": "ゲームIDやタイムスタンプを追加せず、指定されたパスをそのまま使用します。",
+
+  "Options.TitleMusic.Label": "ゲーム内音楽",
+  "Options.TitleMusic.Desc": "ライブラリで選択したゲームのプレビュー音楽をループ再生します。",
+
+  "Options.Discord.Label": "Discordステータス表示",
+  "Options.Discord.Desc": "現在プレイ中のゲームをDiscordのプロフィールに表示します。",
+
+  "Options.Language.Label": "エミュレータの言語",
+  "Options.Language.Desc": "ランチャー全体で使用される言語。変更はすぐに適用されます。",
+
+  "Common.On": "オン",
+  "Common.Off": "オフ",
+
+  "Console.Title": "コンソール",
+  "Console.SearchWatermark": "検索…",
+  "Console.AutoScroll": "自動スクロール",
+  "Console.Split": "ウィンドウを分離",
+  "Console.Copy": "コピー",
+  "Console.Clear": "消去",
+  "Console.WindowTitle": "SharpEmu コンソール",
+
+  "Launch.NoGameSelected": "ゲームが選択されていません",
+  "Launch.NoGameHint": "ライブラリからゲームを選択するか、eboot.bin ファイルを直接開いてください。",
+  "Launch.Idle": "待機中",
+  "Launch.Console": "≡ コンソール",
+  "Launch.Launch": "▶  起動",
+  "Launch.Stop": "■  停止",
+  "Launch.Running": "実行中 — {0}",
+  "Launch.Stopping": "停止中…",
+  "Launch.Exited": "プロセスがコード {0} ({1}) で終了しました",
+  "Launch.ExeNotFound": "SharpEmuの実行ファイルが見つかりません。先に SharpEmu.CLI プロジェクトをビルドしてください（dotnet build）。",
+  "Launch.LogFile": "ログファイル: {0}",
+  "Launch.Command": "$ SharpEmu {0}",
+  "Launch.StartFailed": "エミュレータを起動できませんでした: {0}",
+  "Launch.ProcessExited": "プロセスがコード {0} ({1}) で終了しました。",
+
+  "Exit.Ok": "OK",
+  "Exit.InvalidArguments": "無効な引数",
+  "Exit.EbootNotFound": "eboot が見つかりません",
+  "Exit.RuntimeException": "ランタイム例外",
+  "Exit.EmulationError": "エミュレーションエラー",
+  "Exit.Unknown": "不明",
+
+  "Status.EmulatorLocating": "エミュレータ: 位置を検索中…",
+  "Status.EmulatorPath": "エミュレータ: {0}",
+  "Status.EmulatorNotFound": "エミュレータ: SharpEmuの実行ファイルが見つかりません — 先に SharpEmu.CLI をビルドしてください。",
+  "Status.ScanningLibrary": "ライブラリをスキャン中…",
+  "Status.AddFolderPrompt": "ライブラリに表示するゲームフォルダーを追加してください。",
+  "Status.LibraryScanned": "ライブラリのスキャン完了: {1} 個のフォルダーから {0} 本のゲームを検出。",
+  "Status.CouldNotOpenFolder": "フォルダーを開けませんでした: {0}",
+  "Status.CopiedToClipboard": "「{0}」をクリップボードにコピーしました。",
+  "Status.RemovedFromLibrary": "「{0}」がライブラリから削除されました。復元するにはフォルダーを再追加してください。",
+  "Status.Running": "{0} を実行中",
+  "Status.Stopping": "停止中…",
+  "Status.Idle": "待機中",
+
+  "Clipboard.Path": "パス",
+  "Clipboard.TitleId": "ゲームID",
+
+  "Discord.Playing": "{0} をプレイ中",
+  "Discord.Browsing": "ライブラリを閲覧中",
+
+  "Dialog.ChooseGameFolder": "ゲームが含まれるフォルダーを選択",
+  "Dialog.OpenExecutable": "起動する実行ファイルを開く",
+  "Dialog.PsExecutables": "PlayStation 実行ファイル",
+  "Dialog.SaveLogFile": "ログファイルの保存先を選択",
+  "Dialog.PlainTextFiles": "プレーンテキストファイル",
+  "Dialog.LogFiles": "ログファイル"
+}

src/SharpEmu.GUI/Languages/ko.json

@@ -0,0 +1,129 @@
+{
+  "_languageName": "한국어",
+
+  "Page.Library": "라이브러리",
+  "Page.Options": "옵션",
+  "Page.GameCount.One": "게임 1개",
+  "Page.GameCount.Other": "게임 {0}개",
+
+  "Library.SearchWatermark": "라이브러리 검색…",
+  "Library.AddFolder": "＋ 폴더 추가",
+  "Library.Rescan": "⟳ 다시 스캔",
+  "Library.OpenFile": "파일 열기…",
+
+  "Library.Context.Launch": "실행",
+  "Library.Context.OpenFolder": "게임 폴더 열기",
+  "Library.Context.CopyPath": "경로 복사",
+  "Library.Context.CopyTitleId": "게임 ID 복사",
+  "Library.Context.Remove": "라이브러리에서 제거",
+
+  "Library.Empty.Title": "라이브러리가 비어 있습니다",
+  "Library.Empty.Hint": "시작하려면 게임이 포함된 폴더를 추가하세요.",
+  "Library.Empty.SearchTitle": "검색 결과와 일치하는 게임이 없습니다",
+  "Library.Empty.SearchHint": "라이브러리에 '{0}'와(과) 일치하는 항목이 없습니다.",
+  "Library.Empty.AddFolder": "＋ 게임 폴더 추가",
+
+  "Library.Loading": "라이브러리 불러오는 중…",
+
+  "Options.General": "일반",
+  "Options.Section.Emulation": "에뮬레이션",
+  "Options.Section.Logging": "로깅",
+  "Options.Section.Launcher": "런처",
+
+  "Options.CpuEngine.Label": "CPU 엔진",
+  "Options.CpuEngine.Desc": "게임 코드를 실행하는 데 사용되는 실행 엔진입니다.",
+  "Options.CpuEngine.Native": "네이티브",
+
+  "Options.Strict.Label": "엄격한 동적 라이브러리 해석",
+  "Options.Strict.Desc": "가져온 심볼을 해석할 수 없는 경우 실행을 중단합니다.",
+
+  "Options.LogLevel.Label": "로그 수준",
+  "Options.LogLevel.Desc": "에뮬레이터 콘솔에 표시할 메시지의 세부 정보 수준입니다.",
+  "Options.LogLevel.Trace": "트레이스",
+  "Options.LogLevel.Debug": "디버그",
+  "Options.LogLevel.Info": "정보",
+  "Options.LogLevel.Warning": "경고",
+  "Options.LogLevel.Error": "오류",
+  "Options.LogLevel.Critical": "치명적 오류",
+
+  "Options.TraceImports.Label": "가져오기 트레이스 한도",
+  "Options.TraceImports.Desc": "각 모듈의 처음 N개 가져오기를 트레이스합니다 (0 = 비활성화).",
+
+  "Options.LogToFile.Label": "파일로 저장",
+  "Options.LogToFile.Desc": "에뮬레이터 출력을 로그 파일에 복사합니다.",
+
+  "Options.LogFilePath.Label": "로그 파일 경로",
+  "Options.LogFilePath.Default": "사용자 지정 경로 없음 — 로그는 에뮬레이터 옆의 user/logs 폴더에 저장됩니다.",
+  "Options.LogFilePath.Select": "선택…",
+
+  "Options.OverrideLogFile.Label": "로그 파일 덮어쓰기",
+  "Options.OverrideLogFile.Desc": "게임 ID와 타임스탬프를 추가하는 대신 정확히 이 경로를 사용합니다.",
+
+  "Options.TitleMusic.Label": "게임 음악",
+  "Options.TitleMusic.Desc": "라이브러리에서 선택한 게임의 미리보기 음악을 반복 재생합니다.",
+
+  "Options.Discord.Label": "디스코드 상태 표시",
+  "Options.Discord.Desc": "디스코드 프로필에 현재 실행 중인 게임을 표시합니다.",
+
+  "Options.Language.Label": "에뮬레이터 언어",
+  "Options.Language.Desc": "런처 전체에 사용되는 언어입니다. 변경 사항은 즉시 적용됩니다.",
+
+  "Common.On": "켬",
+  "Common.Off": "끔",
+
+  "Console.Title": "콘솔",
+  "Console.SearchWatermark": "검색…",
+  "Console.AutoScroll": "자동 스크롤",
+  "Console.Split": "창 분리",
+  "Console.Copy": "복사",
+  "Console.Clear": "지우기",
+  "Console.WindowTitle": "SharpEmu 콘솔",
+
+  "Launch.NoGameSelected": "선택된 게임 없음",
+  "Launch.NoGameHint": "라이브러리에서 게임을 선택하거나 eboot.bin 파일을 직접 여세요.",
+  "Launch.Idle": "대기 중",
+  "Launch.Console": "≡ 콘솔",
+  "Launch.Launch": "▶  실행",
+  "Launch.Stop": "■  중지",
+  "Launch.Running": "실행 중 — {0}",
+  "Launch.Stopping": "중지 중…",
+  "Launch.Exited": "프로세스가 코드 {0} ({1})(으)로 종료되었습니다",
+  "Launch.ExeNotFound": "SharpEmu 실행 파일을 찾을 수 없습니다. 먼저 SharpEmu.CLI 프로젝트를 컴파일하세요 (dotnet build).",
+  "Launch.LogFile": "로그 파일: {0}",
+  "Launch.Command": "$ SharpEmu {0}",
+  "Launch.StartFailed": "에뮬레이터를 시작할 수 없습니다: {0}",
+  "Launch.ProcessExited": "프로세스가 코드 {0} ({1})(으)로 종료되었습니다.",
+
+  "Exit.Ok": "확인",
+  "Exit.InvalidArguments": "잘못된 인수",
+  "Exit.EbootNotFound": "eboot을 찾을 수 없음",
+  "Exit.RuntimeException": "런타임 예외",
+  "Exit.EmulationError": "에뮬레이션 오류",
+  "Exit.Unknown": "알 수 없음",
+
+  "Status.EmulatorLocating": "에뮬레이터: 위치 검색 중…",
+  "Status.EmulatorPath": "에뮬레이터: {0}",
+  "Status.EmulatorNotFound": "에뮬레이터: SharpEmu 실행 파일을 찾을 수 없습니다 — 먼저 SharpEmu.CLI를 컴파일하세요.",
+  "Status.ScanningLibrary": "라이브러리 스캔 중…",
+  "Status.AddFolderPrompt": "라이브러리를 채우려면 게임 폴더를 추가하세요.",
+  "Status.LibraryScanned": "라이브러리 스캔 완료: {1}개 폴더에서 {0}개 게임 발견.",
+  "Status.CouldNotOpenFolder": "폴더를 열 수 없습니다: {0}",
+  "Status.CopiedToClipboard": "{0}이(가) 클립보드에 복사되었습니다.",
+  "Status.RemovedFromLibrary": "'{0}'이(가) 라이브러리에서 제거되었습니다. 복구하려면 폴더를 다시 추가하세요.",
+  "Status.Running": "{0} 실행 중",
+  "Status.Stopping": "중지 중…",
+  "Status.Idle": "대기 중",
+
+  "Clipboard.Path": "경로",
+  "Clipboard.TitleId": "게임 ID",
+
+  "Discord.Playing": "{0} 플레이 중",
+  "Discord.Browsing": "라이브러리 둘러보는 중",
+
+  "Dialog.ChooseGameFolder": "게임이 포함된 폴더 선택",
+  "Dialog.OpenExecutable": "실행할 파일 열기",
+  "Dialog.PsExecutables": "PlayStation 실행 파일",
+  "Dialog.SaveLogFile": "로그 파일 저장 위치 선택",
+  "Dialog.PlainTextFiles": "일반 텍스트 파일",
+  "Dialog.LogFiles": "로그 파일"
+}

src/SharpEmu.GUI/Languages/nl.json

@@ -0,0 +1,129 @@
+{
+  "_languageName": "Nederlands",
+
+  "Page.Library": "Bibliotheek",
+  "Page.Options": "Opties",
+  "Page.GameCount.One": "1 game",
+  "Page.GameCount.Other": "{0} games",
+
+  "Library.SearchWatermark": "Zoeken in bibliotheek…",
+  "Library.AddFolder": "＋ Map toevoegen",
+  "Library.Rescan": "⟳ Opnieuw scannen",
+  "Library.OpenFile": "Bestand openen…",
+
+  "Library.Context.Launch": "Starten",
+  "Library.Context.OpenFolder": "Gamemap openen",
+  "Library.Context.CopyPath": "Pad kopiëren",
+  "Library.Context.CopyTitleId": "Titel-ID kopiëren",
+  "Library.Context.Remove": "Verwijderen uit bibliotheek",
+
+  "Library.Empty.Title": "Je bibliotheek is leeg",
+  "Library.Empty.Hint": "Voeg een map met je games toe om te beginnen.",
+  "Library.Empty.SearchTitle": "Geen games komen overeen met je zoekopdracht",
+  "Library.Empty.SearchHint": "Niets in de bibliotheek komt overeen met “{0}”.",
+  "Library.Empty.AddFolder": "＋ Gamemap toevoegen",
+
+  "Library.Loading": "Bibliotheek laden…",
+
+  "Options.General": "Algemeen",
+  "Options.Section.Emulation": "EMULATIE",
+  "Options.Section.Logging": "LOGGING",
+  "Options.Section.Launcher": "LAUNCHER",
+
+  "Options.CpuEngine.Label": "CPU-engine",
+  "Options.CpuEngine.Desc": "Engine die wordt gebruikt om gamecode uit te voeren.",
+  "Options.CpuEngine.Native": "Native",
+
+  "Options.Strict.Label": "Strikte dynlib-resolutie",
+  "Options.Strict.Desc": "Laat het opstarten mislukken wanneer een geïmporteerd symbool niet kan worden opgelost.",
+
+  "Options.LogLevel.Label": "Logniveau",
+  "Options.LogLevel.Desc": "Uitgebreidheid van de console-uitvoer van de emulator.",
+  "Options.LogLevel.Trace": "Trace",
+  "Options.LogLevel.Debug": "Debug",
+  "Options.LogLevel.Info": "Info",
+  "Options.LogLevel.Warning": "Waarschuwing",
+  "Options.LogLevel.Error": "Fout",
+  "Options.LogLevel.Critical": "Kritiek",
+
+  "Options.TraceImports.Label": "Tracelimiet voor imports",
+  "Options.TraceImports.Desc": "Traceer de eerste N imports per module (0 = uit).",
+
+  "Options.LogToFile.Label": "Loggen naar bestand",
+  "Options.LogToFile.Desc": "Stuur de uitvoer van de emulator ook naar een logbestand.",
+
+  "Options.LogFilePath.Label": "Pad naar logbestand",
+  "Options.LogFilePath.Default": "Geen aangepast pad — logs komen terecht in user/logs naast de emulator.",
+  "Options.LogFilePath.Select": "Selecteren…",
+
+  "Options.OverrideLogFile.Label": "Logbestand overschrijven",
+  "Options.OverrideLogFile.Desc": "Gebruik het exacte bestandspad in plaats van de titel-ID en tijdstempel toe te voegen.",
+
+  "Options.TitleMusic.Label": "Titelmuziek",
+  "Options.TitleMusic.Desc": "Herhaal de voorbeeldmuziek van de geselecteerde game in de bibliotheek.",
+
+  "Options.Discord.Label": "Discord-aanwezigheid",
+  "Options.Discord.Desc": "Toon de actieve game op je Discord-profiel.",
+
+  "Options.Language.Label": "Taal van de emulator",
+  "Options.Language.Desc": "Taal die in de hele launcher wordt gebruikt. Wordt direct toegepast.",
+
+  "Common.On": "Aan",
+  "Common.Off": "Uit",
+
+  "Console.Title": "CONSOLE",
+  "Console.SearchWatermark": "Zoeken...",
+  "Console.AutoScroll": "Automatisch scrollen",
+  "Console.Split": "Splitsen",
+  "Console.Copy": "Kopiëren",
+  "Console.Clear": "Wissen",
+  "Console.WindowTitle": "SharpEmu-console",
+
+  "Launch.NoGameSelected": "Geen game geselecteerd",
+  "Launch.NoGameHint": "Kies een game uit de bibliotheek, of open direct een eboot.bin-bestand.",
+  "Launch.Idle": "Inactief",
+  "Launch.Console": "≡ Console",
+  "Launch.Launch": "▶  Starten",
+  "Launch.Stop": "■  Stoppen",
+  "Launch.Running": "Actief — {0}",
+  "Launch.Stopping": "Stoppen…",
+  "Launch.Exited": "Afgesloten met code {0} ({1})",
+  "Launch.ExeNotFound": "SharpEmu-uitvoerbaar bestand niet gevonden. Bouw eerst het SharpEmu.CLI-project (dotnet build).",
+  "Launch.LogFile": "Logbestand: {0}",
+  "Launch.Command": "$ SharpEmu {0}",
+  "Launch.StartFailed": "Starten van de emulator mislukt: {0}",
+  "Launch.ProcessExited": "Proces afgesloten met code {0} ({1}).",
+
+  "Exit.Ok": "OK",
+  "Exit.InvalidArguments": "ongeldige argumenten",
+  "Exit.EbootNotFound": "eboot niet gevonden",
+  "Exit.RuntimeException": "runtime-uitzondering",
+  "Exit.EmulationError": "emulatiefout",
+  "Exit.Unknown": "onbekend",
+
+  "Status.EmulatorLocating": "Emulator: zoeken…",
+  "Status.EmulatorPath": "Emulator: {0}",
+  "Status.EmulatorNotFound": "Emulator: SharpEmu-uitvoerbaar bestand niet gevonden — bouw eerst SharpEmu.CLI.",
+  "Status.ScanningLibrary": "Bibliotheek scannen…",
+  "Status.AddFolderPrompt": "Voeg een gamemap toe om de bibliotheek te vullen.",
+  "Status.LibraryScanned": "Bibliotheek gescand: {0} game(s) in {1} map(pen).",
+  "Status.CouldNotOpenFolder": "Kan map niet openen: {0}",
+  "Status.CopiedToClipboard": "{0} gekopieerd naar klembord.",
+  "Status.RemovedFromLibrary": "“{0}” verwijderd uit de bibliotheek. Voeg de map opnieuw toe om dit te herstellen.",
+  "Status.Running": "Actief {0}",
+  "Status.Stopping": "Stoppen…",
+  "Status.Idle": "Inactief",
+
+  "Clipboard.Path": "Pad",
+  "Clipboard.TitleId": "Titel-ID",
+
+  "Discord.Playing": "Speelt {0}",
+  "Discord.Browsing": "Bladert door de bibliotheek",
+
+  "Dialog.ChooseGameFolder": "Kies een map met games",
+  "Dialog.OpenExecutable": "Open een uitvoerbaar bestand om te starten",
+  "Dialog.PsExecutables": "PS-uitvoerbare bestanden",
+  "Dialog.SaveLogFile": "Selecteer waar het logbestand moet worden opgeslagen",
+  "Dialog.PlainTextFiles": "Platte tekstbestanden",
+  "Dialog.LogFiles": "Logbestanden"
+}

src/SharpEmu.GUI/Languages/pt.json

@@ -0,0 +1,146 @@
+{
+  "_languageName": "Português (Portugal)",
+
+  "Page.Library": "Biblioteca",
+  "Page.Options": "Opções",
+  "Page.GameCount.One": "1 jogo",
+  "Page.GameCount.Other": "{0} jogos",
+
+  "Library.SearchWatermark": "Pesquisar biblioteca…",
+  "Library.AddFolder": "＋ Adicionar pasta",
+  "Library.Rescan": "⟳ Reanalisar",
+  "Library.OpenFile": "Abrir ficheiro…",
+
+  "Library.Context.Launch": "Iniciar",
+  "Library.Context.OpenFolder": "Abrir pasta do jogo",
+  "Library.Context.CopyPath": "Copiar caminho",
+  "Library.Context.CopyTitleId": "Copiar ID do título",
+  "Library.Context.Remove": "Remover da biblioteca",
+
+  "Library.Empty.Title": "A sua biblioteca está vazia",
+  "Library.Empty.Hint": "Adicione uma pasta com os seus jogos para começar.",
+  "Library.Empty.SearchTitle": "Nenhum jogo corresponde à sua pesquisa",
+  "Library.Empty.SearchHint": "Nada na biblioteca corresponde a “{0}”.",
+  "Library.Empty.AddFolder": "＋ Adicionar pasta de jogos",
+
+  "Library.Loading": "A carregar biblioteca…",
+
+  "Options.General": "Geral",
+  "Options.Env.Tab": "Ambiente",
+  "Options.Section.Environment": "VARIÁVEIS DE AMBIENTE",
+  "Options.Env.Desc": "Switches passados ao emulador como variáveis de ambiente no arranque.",
+  "Options.Env.Bthid.Desc": "Reporta o Bluetooth HID como indisponível para títulos cujo middleware de volante/FFB fica à espera indefinidamente.\nDeixe desativado normalmente. Alguns títulos bloqueiam quando a inicialização falha.",
+  "Options.Env.LoopGuard.Desc": "Não force o encerramento de títulos que repetem a mesma chamada durante demasiado tempo.\nExperimente isto quando um jogo fecha sozinho durante o carregamento.",
+  "Options.Env.VkValidation.Desc": "Ativa as camadas de validação do Vulkan para depuração da GPU.\nLento. Requer que o Vulkan SDK esteja instalado.",
+  "Options.Env.DumpSpirv.Desc": "Extrai os shaders AGC e as respetivas traduções SPIR-V para a pasta shader-dumps.\nUtilize ao reportar problemas de shaders ou renderização.",
+  "Options.Env.LogDirectMemory.Desc": "Regista alocações de memória direta e falhas na consola.\nUtilize quando um jogo aborta ou fecha durante o arranque.",
+  "Options.Env.LogNp.Desc": "Regista chamadas da biblioteca NP (PlayStation Network) na consola.",
+  "Options.Section.Emulation": "EMULAÇÃO",
+  "Options.Section.Logging": "REGISTOS",
+  "Options.Section.Launcher": "LANÇADOR",
+
+  "Options.CpuEngine.Label": "Motor de CPU",
+  "Options.CpuEngine.Desc": "Motor de execução utilizado para correr o código do jogo.",
+  "Options.CpuEngine.Native": "Nativo",
+
+  "Options.Strict.Label": "Resolução estrita de dynlib",
+  "Options.Strict.Desc": "Falha o arranque quando um símbolo importado não pode ser resolvido.",
+
+  "Options.LogLevel.Label": "Nível de registo",
+  "Options.LogLevel.Desc": "Nível de detalhe da saída da consola do emulador.",
+  "Options.LogLevel.Trace": "Rastreio",
+  "Options.LogLevel.Debug": "Depuração",
+  "Options.LogLevel.Info": "Informação",
+  "Options.LogLevel.Warning": "Aviso",
+  "Options.LogLevel.Error": "Erro",
+  "Options.LogLevel.Critical": "Crítico",
+
+  "Options.TraceImports.Label": "Limite de rastreio de importações",
+  "Options.TraceImports.Desc": "Rastreia as primeiras N importações por módulo (0 = desativado).",
+
+  "Options.LogToFile.Label": "Registar para ficheiro",
+  "Options.LogToFile.Desc": "Duplicar a saída do emulador para um ficheiro de registo.",
+
+  "Options.LogFilePath.Label": "Caminho do ficheiro de registo",
+  "Options.LogFilePath.Default": "Sem caminho personalizado — os registos vão para user/logs junto ao emulador.",
+  "Options.LogFilePath.Select": "Selecionar…",
+
+  "Options.OverrideLogFile.Label": "Substituir ficheiro de registo",
+  "Options.OverrideLogFile.Desc": "Utilizar o caminho de ficheiro exato em vez de acrescentar o ID do título e a hora.",
+
+  "Options.TitleMusic.Label": "Música do título",
+  "Options.TitleMusic.Desc": "Repetir em loop a música de pré-visualização do jogo selecionado na biblioteca.",
+
+  "Options.Discord.Label": "Presença no Discord",
+  "Options.Discord.Desc": "Mostrar o jogo em execução no seu perfil do Discord.",
+
+  "Options.Language.Label": "Idioma do emulador",
+  "Options.Language.Desc": "Idioma utilizado em todo o lançador. Aplica-se de imediato.",
+
+  "Common.On": "Ativado",
+  "Common.Off": "Desativado",
+
+  "Console.Title": "CONSOLA",
+  "Console.SearchWatermark": "Pesquisar...",
+  "Console.AutoScroll": "Deslocamento automático",
+  "Console.Split": "Dividir",
+  "Console.Copy": "Copiar",
+  "Console.Clear": "Limpar",
+  "Console.WindowTitle": "Consola do SharpEmu",
+
+  "Launch.NoGameSelected": "Nenhum jogo selecionado",
+  "Launch.NoGameHint": "Escolha um jogo da biblioteca ou abra um eboot.bin diretamente.",
+  "Launch.Idle": "Inativo",
+  "Launch.Console": "≡ Consola",
+  "Launch.Launch": "▶  Iniciar",
+  "Launch.Stop": "■  Parar",
+  "Launch.Running": "Em execução — {0}",
+  "Launch.Stopping": "A parar…",
+  "Launch.Exited": "Terminou com o código {0} ({1})",
+  "Launch.ExeNotFound": "Executável do SharpEmu não encontrado. Compile primeiro o projeto SharpEmu.CLI (dotnet build).",
+  "Launch.LogFile": "Ficheiro de registo: {0}",
+  "Launch.Command": "$ SharpEmu {0}",
+  "Launch.StartFailed": "Falha ao iniciar o emulador: {0}",
+  "Launch.ProcessExited": "O processo terminou com o código {0} ({1}).",
+
+  "Exit.Ok": "OK",
+  "Exit.InvalidArguments": "argumentos inválidos",
+  "Exit.EbootNotFound": "eboot não encontrado",
+  "Exit.RuntimeException": "exceção em tempo de execução",
+  "Exit.EmulationError": "erro de emulação",
+  "Exit.Unknown": "desconhecido",
+
+  "Status.EmulatorLocating": "Emulador: a localizar…",
+  "Status.EmulatorPath": "Emulador: {0}",
+  "Status.EmulatorNotFound": "Emulador: executável do SharpEmu não encontrado — compile primeiro o SharpEmu.CLI.",
+  "Status.ScanningLibrary": "A analisar biblioteca…",
+  "Status.AddFolderPrompt": "Adicione uma pasta de jogos para preencher a biblioteca.",
+  "Status.LibraryScanned": "Biblioteca analisada: {0} jogo(s) em {1} pasta(s).",
+  "Status.CouldNotOpenFolder": "Não foi possível abrir a pasta: {0}",
+  "Status.CopiedToClipboard": "{0} copiado para a área de transferência.",
+  "Status.RemovedFromLibrary": "“{0}” removido da biblioteca. Adicione novamente a pasta para o restaurar.",
+  "Status.Running": "A executar {0}",
+  "Status.Stopping": "A parar…",
+  "Status.Idle": "Inativo",
+
+  "Clipboard.Path": "Caminho",
+  "Clipboard.TitleId": "ID do título",
+
+  "Discord.Playing": "A jogar {0}",
+  "Discord.Browsing": "A navegar na biblioteca",
+
+  "Dialog.ChooseGameFolder": "Escolha uma pasta com jogos",
+  "Dialog.OpenExecutable": "Abrir um executável para iniciar",
+  "Dialog.PsExecutables": "Executáveis PS",
+  "Dialog.SaveLogFile": "Selecione onde guardar o ficheiro de registo",
+  "Dialog.PlainTextFiles": "Ficheiros de Texto Simples",
+  "Dialog.LogFiles": "Ficheiros de Registo",
+
+  "Options.About" : "Sobre",
+  "About.Github.Label": "GitHub",
+  "About.Github.Desc": "Código-fonte, problemas e desenvolvimento do projeto.",
+  "About.Discord.Label": "Discord",
+  "About.Discord.Desc": "Junte-se à comunidade, obtenha suporte e acompanhe o desenvolvimento.",
+  "About.GithubButton": "Contribua no GitHub!",
+  "About.DiscordButton": "Junte-se ao nosso Discord!"
+}

src/SharpEmu.GUI/Localization.cs

@@ -22,6 +22,8 @@ public sealed class Localization
     private const string EmbeddedResourceSuffix = ".json";
 
     private Dictionary<string, string> _strings = new();
+    private Dictionary<string, string> _fallbackStrings = new();
+
 
     private Localization()
     {
@@ -32,7 +34,16 @@ public sealed class Localization
 
     public string CurrentCode { get; private set; } = "en";
 
-    public string Get(string key) => _strings.TryGetValue(key, out var value) ? value : key;
+    public string Get(string key)
+    {
+        if (_strings.TryGetValue(key, out var value))
+            return value;
+
+        if (_fallbackStrings.TryGetValue(key, out var fallbackValue))
+            return fallbackValue;
+
+        return key;
+    }
 
     public string Format(string key, params object?[] args) => string.Format(Get(key), args);
 
@@ -74,13 +85,46 @@ public sealed class Localization
     }
 
     /// <summary>Loads a language by code (e.g. "en"): a loose override file first, then the embedded copy.</summary>
+    /// english is the fallback language
     public void Load(string code)
     {
-        if (!TryLoadLooseFile(code) && !TryLoadEmbedded(code) &&
-            !string.Equals(code, "en", StringComparison.OrdinalIgnoreCase))
+        if (_fallbackStrings.Count == 0 && !string.Equals(code, "en", StringComparison.OrdinalIgnoreCase))
         {
-            _ = TryLoadLooseFile("en") || TryLoadEmbedded("en");
+            if (!TryLoadLooseFile("en", out var fallback) && !TryLoadEmbedded("en", out fallback))
+            {
+                fallback = new Dictionary<string, string>();
+            }
+            _fallbackStrings = fallback;
         }
+        else if (string.Equals(code, "en", StringComparison.OrdinalIgnoreCase))
+        {
+            if (TryLoadLooseFile("en", out var enDict) || TryLoadEmbedded("en", out enDict))
+            {
+                _strings = enDict;
+                _fallbackStrings = enDict;
+            }
+            else
+            {
+                _strings = new Dictionary<string, string>();
+                _fallbackStrings = new Dictionary<string, string>();
+            }
+            CurrentCode = "en";
+            return;
+        }
+
+        // Load the requested language
+        if (TryLoadLooseFile(code, out var loaded) || TryLoadEmbedded(code, out loaded))
+        {
+            _strings = loaded;
+        }
+        else
+        {
+            if (_fallbackStrings.Count > 0)
+                _strings = new Dictionary<string, string>(_fallbackStrings);
+            else
+                _strings = new Dictionary<string, string>();
+        }
+        CurrentCode = code;
     }
 
     private static IEnumerable<string> EmbeddedLanguageCodes()
@@ -149,16 +193,64 @@ public sealed class Localization
         }
     }
 
-    private bool TryLoad(string code, string json)
+    private bool TryLoadLooseFile(string code, out Dictionary<string, string> result)
+    {
+        result = new Dictionary<string, string>();
+        try
+        {
+            var path = Path.Combine(LanguagesDirectory, $"{code}.json");
+            if (!File.Exists(path))
+                return false;
+
+            var json = File.ReadAllText(path);
+            return TryLoad(json, out result);
+        }
+        catch (Exception)
+        {
+            return false;
+        }
+    }
+
+    private bool TryLoadEmbedded(string code, out Dictionary<string, string> result)
+    {
+        result = new Dictionary<string, string>();
+        try
+        {
+            using var stream = OpenEmbeddedLanguageStream(code);
+            if (stream is null)
+                return false;
+
+            using var reader = new StreamReader(stream);
+            var json = reader.ReadToEnd();
+            return TryLoad(json, out result);
+        }
+        catch (Exception)
+        {
+            return false;
+        }
+    }
+
+    private static bool TryLoad(string json, out Dictionary<string, string> result)
     {
         var loaded = JsonSerializer.Deserialize<Dictionary<string, string>>(json);
         if (loaded is null)
         {
+            result = new Dictionary<string, string>();
             return false;
         }
 
-        _strings = loaded;
-        CurrentCode = code;
+        result = loaded;
         return true;
     }
-}
+    
+    private bool TryLoad(string code, string json)
+    {
+        if (TryLoad(json, out var dict))
+        {
+            _strings = dict;
+            CurrentCode = code;
+            return true;
+        }
+        return false;
+    }
+}

src/SharpEmu.GUI/MainWindow.axaml

@@ -317,6 +317,154 @@ SPDX-License-Identifier: GPL-2.0-or-later
                       </Grid>
                     </StackPanel>
                   </Border>
+                  <Border Classes="card">
+                    <StackPanel Spacing="14">
+                      <TextBlock x:Name="AboutSectionTitle"
+                                Classes="sectionTitle"
+                                Text="ABOUT" />
+                      
+                      <!--Github-->
+                      <Grid ColumnDefinitions="*,Auto">
+                        <StackPanel Grid.Column="0"
+                                      Orientation="Horizontal"
+                                      Spacing="8"
+                                      VerticalAlignment="Center">
+                          <Image Source="avares://SharpEmu.GUI/Assets/github.png"
+                                    Width="20"
+                                    Height="20"
+                                    VerticalAlignment="Center" />
+                          <StackPanel VerticalAlignment="Center"
+                                          Spacing="2">
+                            <TextBlock x:Name="GithubLabel"
+                                            Text="GitHub"
+                                            FontSize="13" />
+                            <TextBlock x:Name="GithubDesc"
+                                            Text="Source code, issues and project development."
+                                            FontSize="11"
+                                            Foreground="{StaticResource MutedBrush}"
+                                            TextWrapping="Wrap" />
+                          </StackPanel>
+                        </StackPanel>
+
+                        <Button Grid.Column="1"
+                                x:Name="GithubButton"
+                                Classes="ghost"
+                                Content="Open"
+                                VerticalAlignment="Center" />
+                      </Grid>
+
+                      <!--Discord-->
+                      <Grid ColumnDefinitions="*,Auto">
+                        <StackPanel Grid.Column="0"
+                                        Orientation="Horizontal"
+                                        Spacing="8"
+                                        VerticalAlignment="Center">
+                          <Image Source="avares://SharpEmu.GUI/Assets/discord.png"
+                                  Width="20"
+                                  Height="20"
+                                  VerticalAlignment="Center" />
+                          <StackPanel VerticalAlignment="Center"
+                                      Spacing="2">
+                            <TextBlock x:Name="DiscordServerLabel"
+                                      Text="Discord"
+                                      FontSize="13" />
+                            <TextBlock x:Name="DiscordServerDesc"
+                                      Text="Join the community, get support and follow development."
+                                      FontSize="11"
+                                      Foreground="{StaticResource MutedBrush}"
+                                      TextWrapping="Wrap" />
+                          </StackPanel>
+                        </StackPanel>
+
+                        <Button Grid.Column="1"
+                                x:Name="DiscordButton"
+                                Classes="ghost"
+                                Content="Join"
+                                VerticalAlignment="Center" />
+                      </Grid>
+                    </StackPanel>
+                  </Border>
+                </StackPanel>
+              </ScrollViewer>
+            </TabItem>
+            <TabItem x:Name="EnvTabItem" Header="Environment" FontSize="15">
+              <ScrollViewer>
+                <StackPanel Margin="0,14,0,16" Spacing="16" MaxWidth="1280" HorizontalAlignment="Left">
+
+                  <Border Classes="card">
+                    <StackPanel Spacing="14">
+                      <TextBlock x:Name="EnvSectionTitle" Classes="sectionTitle" Text="ENVIRONMENT VARIABLES" />
+                      <TextBlock x:Name="EnvDesc"
+                                 Text="Switches passed to the emulator as environment variables at launch."
+                                 FontSize="11" Foreground="{StaticResource MutedBrush}" TextWrapping="Wrap" />
+
+                      <Grid ColumnDefinitions="*,Auto">
+                        <StackPanel VerticalAlignment="Center" Spacing="2" Margin="0,0,16,0">
+                          <TextBlock Text="SHARPEMU_BTHID_UNAVAILABLE" FontSize="13" FontFamily="Consolas,monospace" />
+                          <TextBlock x:Name="EnvBthidDesc"
+                                     Text="Report Bluetooth HID as unavailable for titles whose wheel/FFB middleware polls forever.&#10;Leave off normally. Some titles freeze when init fails."
+                                     FontSize="11" Foreground="{StaticResource MutedBrush}" TextWrapping="Wrap" />
+                        </StackPanel>
+                        <ToggleSwitch Grid.Column="1" x:Name="EnvBthidToggle" OnContent="On" OffContent="Off"
+                                      VerticalAlignment="Center" />
+                      </Grid>
+
+                      <Grid ColumnDefinitions="*,Auto">
+                        <StackPanel VerticalAlignment="Center" Spacing="2" Margin="0,0,16,0">
+                          <TextBlock Text="SHARPEMU_DISABLE_IMPORT_LOOP_GUARD" FontSize="13" FontFamily="Consolas,monospace" />
+                          <TextBlock x:Name="EnvLoopGuardDesc"
+                                     Text="Do not force quit titles that repeat the same call for too long.&#10;Try this when a game exits on its own while loading."
+                                     FontSize="11" Foreground="{StaticResource MutedBrush}" TextWrapping="Wrap" />
+                        </StackPanel>
+                        <ToggleSwitch Grid.Column="1" x:Name="EnvLoopGuardToggle" OnContent="On" OffContent="Off"
+                                      VerticalAlignment="Center" />
+                      </Grid>
+
+                      <Grid ColumnDefinitions="*,Auto">
+                        <StackPanel VerticalAlignment="Center" Spacing="2" Margin="0,0,16,0">
+                          <TextBlock Text="SHARPEMU_VK_VALIDATION" FontSize="13" FontFamily="Consolas,monospace" />
+                          <TextBlock x:Name="EnvVkValidationDesc"
+                                     Text="Enable Vulkan validation layers for GPU debugging.&#10;Slow. Requires the Vulkan SDK to be installed."
+                                     FontSize="11" Foreground="{StaticResource MutedBrush}" TextWrapping="Wrap" />
+                        </StackPanel>
+                        <ToggleSwitch Grid.Column="1" x:Name="EnvVkValidationToggle" OnContent="On" OffContent="Off"
+                                      VerticalAlignment="Center" />
+                      </Grid>
+
+                      <Grid ColumnDefinitions="*,Auto">
+                        <StackPanel VerticalAlignment="Center" Spacing="2" Margin="0,0,16,0">
+                          <TextBlock Text="SHARPEMU_DUMP_SPIRV" FontSize="13" FontFamily="Consolas,monospace" />
+                          <TextBlock x:Name="EnvDumpSpirvDesc"
+                                     Text="Dump AGC shaders and their SPIR-V translations to the shader-dumps folder.&#10;Use when reporting shader or rendering bugs."
+                                     FontSize="11" Foreground="{StaticResource MutedBrush}" TextWrapping="Wrap" />
+                        </StackPanel>
+                        <ToggleSwitch Grid.Column="1" x:Name="EnvDumpSpirvToggle" OnContent="On" OffContent="Off"
+                                      VerticalAlignment="Center" />
+                      </Grid>
+
+                      <Grid ColumnDefinitions="*,Auto">
+                        <StackPanel VerticalAlignment="Center" Spacing="2" Margin="0,0,16,0">
+                          <TextBlock Text="SHARPEMU_LOG_DIRECT_MEMORY" FontSize="13" FontFamily="Consolas,monospace" />
+                          <TextBlock x:Name="EnvLogDirectMemoryDesc"
+                                     Text="Log direct memory allocations and failures to the console.&#10;Use when a game aborts or exits during boot."
+                                     FontSize="11" Foreground="{StaticResource MutedBrush}" TextWrapping="Wrap" />
+                        </StackPanel>
+                        <ToggleSwitch Grid.Column="1" x:Name="EnvLogDirectMemoryToggle" OnContent="On" OffContent="Off"
+                                      VerticalAlignment="Center" />
+                      </Grid>
+
+                      <Grid ColumnDefinitions="*,Auto">
+                        <StackPanel VerticalAlignment="Center" Spacing="2" Margin="0,0,16,0">
+                          <TextBlock Text="SHARPEMU_LOG_NP" FontSize="13" FontFamily="Consolas,monospace" />
+                          <TextBlock x:Name="EnvLogNpDesc"
+                                     Text="Log NP (PlayStation Network) library calls to the console."
+                                     FontSize="11" Foreground="{StaticResource MutedBrush}" TextWrapping="Wrap" />
+                        </StackPanel>
+                        <ToggleSwitch Grid.Column="1" x:Name="EnvLogNpToggle" OnContent="On" OffContent="Off"
+                                      VerticalAlignment="Center" />
+                      </Grid>
+                    </StackPanel>
+                  </Border>
 
                 </StackPanel>
               </ScrollViewer>

src/SharpEmu.GUI/MainWindow.axaml.cs

@@ -12,7 +12,8 @@ using Avalonia.Platform;
 using Avalonia.Platform.Storage;
 using Avalonia.Threading;
 using Avalonia.VisualTree;
-using SharpEmu.Libs.Pad;
+using SharpEmu.HLE.Host;
+using SharpEmu.HLE.Host.Windows;
 using SharpEmu.Logging;
 using System.Collections.Concurrent;
 using System.Collections.ObjectModel;
@@ -62,7 +63,7 @@ public partial class MainWindow : Window
 
     // Controller navigation state.
     private readonly DispatcherTimer _gamepadTimer;
-    private uint _previousPadButtons;
+    private HostGamepadButtons _previousPadButtons;
     private long _navLeftNextAt;
     private long _navRightNextAt;
     private long _navUpNextAt;
@@ -125,6 +126,18 @@ public partial class MainWindow : Window
             UpdateDiscordPresence();
         };
         SelectLogFilePathButton.Click += async (_, _) => await SelectLogFilePathAsync();
+        EnvBthidToggle.IsCheckedChanged += (_, _) =>
+            SetEnvironmentToggle("SHARPEMU_BTHID_UNAVAILABLE", EnvBthidToggle.IsChecked == true);
+        EnvLoopGuardToggle.IsCheckedChanged += (_, _) =>
+            SetEnvironmentToggle("SHARPEMU_DISABLE_IMPORT_LOOP_GUARD", EnvLoopGuardToggle.IsChecked == true);
+        EnvVkValidationToggle.IsCheckedChanged += (_, _) =>
+            SetEnvironmentToggle("SHARPEMU_VK_VALIDATION", EnvVkValidationToggle.IsChecked == true);
+        EnvDumpSpirvToggle.IsCheckedChanged += (_, _) =>
+            SetEnvironmentToggle("SHARPEMU_DUMP_SPIRV", EnvDumpSpirvToggle.IsChecked == true);
+        EnvLogDirectMemoryToggle.IsCheckedChanged += (_, _) =>
+            SetEnvironmentToggle("SHARPEMU_LOG_DIRECT_MEMORY", EnvLogDirectMemoryToggle.IsChecked == true);
+        EnvLogNpToggle.IsCheckedChanged += (_, _) =>
+            SetEnvironmentToggle("SHARPEMU_LOG_NP", EnvLogNpToggle.IsChecked == true);
         LanguageBox.SelectionChanged += (_, _) => OnLanguageChanged();
 
         GameList.AddHandler(ContextRequestedEvent, OnGameContextRequested, RoutingStrategies.Tunnel);
@@ -139,14 +152,33 @@ public partial class MainWindow : Window
         Opened += async (_, _) => await OnOpenedAsync();
         Closing += (_, _) => OnWindowClosing();
 
-        DualSenseReader.EnsureStarted();
-        XInputReader.EnsureStarted();
+        WindowsDualSenseReader.EnsureStarted();
+        WindowsXInputReader.EnsureStarted();
         _gamepadTimer = new DispatcherTimer
         {
             Interval = TimeSpan.FromMilliseconds(50),
         };
         _gamepadTimer.Tick += (_, _) => PollGamepad();
         _gamepadTimer.Start();
+
+
+        GithubButton.Click += (_, _) =>
+        {
+            Process.Start(new ProcessStartInfo
+            {
+                FileName = "https://github.com/par274/sharpemu",
+                UseShellExecute = true
+            });
+        };
+
+        DiscordButton.Click += (_, _) =>
+        {
+            Process.Start(new ProcessStartInfo
+            {
+                FileName = "https://discord.com/invite/6GejPEDqpc",
+                UseShellExecute = true
+            });
+        };
     }
 
     /// <summary>
@@ -193,9 +225,9 @@ public partial class MainWindow : Window
     private void PollGamepad()
     {
         // DualSense wins when both are connected; XInput covers Xbox pads.
-        if (!DualSenseReader.TryGetState(out var pad) && !XInputReader.TryGetState(out pad))
+        if (!WindowsDualSenseReader.TryGetState(out var pad) && !WindowsXInputReader.TryGetState(out pad))
         {
-            _previousPadButtons = 0;
+            _previousPadButtons = HostGamepadButtons.None;
             return;
         }
 
@@ -208,12 +240,12 @@ public partial class MainWindow : Window
         }
 
         var shoulderPressed = pad.Buttons & ~_previousPadButtons;
-        if ((shoulderPressed & OrbisPadButton.L1) != 0)
+        if ((shoulderPressed & HostGamepadButtons.L1) != 0)
         {
             SetActivePage(0);
         }
 
-        if ((shoulderPressed & OrbisPadButton.R1) != 0)
+        if ((shoulderPressed & HostGamepadButtons.R1) != 0)
         {
             SetActivePage(1);
         }
@@ -225,10 +257,10 @@ public partial class MainWindow : Window
         }
 
         var now = Environment.TickCount64;
-        var left = (pad.Buttons & 0x0080) != 0 || pad.LeftX < 64;
-        var right = (pad.Buttons & 0x0020) != 0 || pad.LeftX > 192;
-        var up = (pad.Buttons & 0x0010) != 0 || pad.LeftY < 64;
-        var down = (pad.Buttons & 0x0040) != 0 || pad.LeftY > 192;
+        var left = (pad.Buttons & HostGamepadButtons.Left) != 0 || pad.LeftX < 64;
+        var right = (pad.Buttons & HostGamepadButtons.Right) != 0 || pad.LeftX > 192;
+        var up = (pad.Buttons & HostGamepadButtons.Up) != 0 || pad.LeftY < 64;
+        var down = (pad.Buttons & HostGamepadButtons.Down) != 0 || pad.LeftY > 192;
 
         if (ShouldNavigate(left, ref _navLeftNextAt, now))
         {
@@ -251,12 +283,12 @@ public partial class MainWindow : Window
         }
 
         var pressed = pad.Buttons & ~_previousPadButtons;
-        if ((pressed & 0x4000) != 0) // Cross
+        if ((pressed & HostGamepadButtons.Cross) != 0)
         {
             LaunchSelected();
         }
 
-        if ((pressed & 0x2000) != 0) // Circle
+        if ((pressed & HostGamepadButtons.Circle) != 0)
         {
             StopEmulator();
         }
@@ -384,6 +416,15 @@ public partial class MainWindow : Window
         LoadingStateText.Text = loc.Get("Library.Loading");
 
         GeneralTabItem.Header = loc.Get("Options.General");
+        EnvTabItem.Header = loc.Get("Options.Env.Tab");
+        EnvSectionTitle.Text = loc.Get("Options.Section.Environment");
+        EnvDesc.Text = loc.Get("Options.Env.Desc");
+        EnvBthidDesc.Text = loc.Get("Options.Env.Bthid.Desc");
+        EnvLoopGuardDesc.Text = loc.Get("Options.Env.LoopGuard.Desc");
+        EnvVkValidationDesc.Text = loc.Get("Options.Env.VkValidation.Desc");
+        EnvDumpSpirvDesc.Text = loc.Get("Options.Env.DumpSpirv.Desc");
+        EnvLogDirectMemoryDesc.Text = loc.Get("Options.Env.LogDirectMemory.Desc");
+        EnvLogNpDesc.Text = loc.Get("Options.Env.LogNp.Desc");
         EmulationSectionTitle.Text = loc.Get("Options.Section.Emulation");
         LoggingSectionTitle.Text = loc.Get("Options.Section.Logging");
         LauncherSectionTitle.Text = loc.Get("Options.Section.Launcher");
@@ -443,6 +484,14 @@ public partial class MainWindow : Window
         LaunchButton.Content = loc.Get("Launch.Launch");
         StopButton.Content = loc.Get("Launch.Stop");
 
+        AboutSectionTitle.Text = loc.Get("Options.About");
+        GithubLabel.Text = loc.Get("About.Github.Label");
+        GithubDesc.Text = loc.Get("About.Github.Desc");
+        DiscordServerLabel.Text = loc.Get("About.Discord.Label");
+        DiscordServerDesc.Text = loc.Get("About.Discord.Desc");
+        GithubButton.Content = loc.Get("About.GithubButton");
+        DiscordButton.Content = loc.Get("About.DiscordButton");
+
         UpdateEmptyStateTexts();
         UpdateSelectedGameTexts();
     }
@@ -557,9 +606,34 @@ public partial class MainWindow : Window
         OverrideLogFileToggle.IsChecked = _settings.OverrideLogFile;
         TitleMusicToggle.IsChecked = _settings.PlayTitleMusic;
         DiscordToggle.IsChecked = _settings.DiscordRichPresence;
+        EnvBthidToggle.IsChecked = _settings.EnvironmentToggles.Contains("SHARPEMU_BTHID_UNAVAILABLE");
+        EnvLoopGuardToggle.IsChecked = _settings.EnvironmentToggles.Contains("SHARPEMU_DISABLE_IMPORT_LOOP_GUARD");
+        EnvVkValidationToggle.IsChecked = _settings.EnvironmentToggles.Contains("SHARPEMU_VK_VALIDATION");
+        EnvDumpSpirvToggle.IsChecked = _settings.EnvironmentToggles.Contains("SHARPEMU_DUMP_SPIRV");
+        EnvLogDirectMemoryToggle.IsChecked = _settings.EnvironmentToggles.Contains("SHARPEMU_LOG_DIRECT_MEMORY");
+        EnvLogNpToggle.IsChecked = _settings.EnvironmentToggles.Contains("SHARPEMU_LOG_NP");
         UpdateLogFilePathText();
     }
 
+    // Environment variables set on this process at the previous launch; children
+    // inherit the process environment, so stale names must be cleared explicitly.
+    private readonly HashSet<string> _appliedEnvironmentVariables = new(StringComparer.OrdinalIgnoreCase);
+
+    private void SetEnvironmentToggle(string name, bool enabled)
+    {
+        if (enabled)
+        {
+            if (!_settings.EnvironmentToggles.Contains(name))
+            {
+                _settings.EnvironmentToggles.Add(name);
+            }
+        }
+        else
+        {
+            _settings.EnvironmentToggles.Remove(name);
+        }
+    }
+
     private string SelectedLogLevel()
     {
         return LogLevelBox.SelectedIndex switch
@@ -1375,6 +1449,24 @@ public partial class MainWindow : Window
             Localization.Instance.Format("Launch.Command", string.Join(' ', arguments)),
             DimLineBrush);
 
+        // Apply the enabled switches to this process; both emulator launch paths
+        // (CreateProcessW and Process.Start) inherit it. Clear switches turned
+        // off since the previous launch.
+        foreach (var staleName in _appliedEnvironmentVariables)
+        {
+            if (!_settings.EnvironmentToggles.Contains(staleName))
+            {
+                Environment.SetEnvironmentVariable(staleName, null);
+            }
+        }
+
+        _appliedEnvironmentVariables.Clear();
+        foreach (var name in _settings.EnvironmentToggles)
+        {
+            Environment.SetEnvironmentVariable(name, "1");
+            _appliedEnvironmentVariables.Add(name);
+        }
+
         var emulator = new EmulatorProcess();
         emulator.OutputReceived += (line, isError) => _pendingLines.Enqueue((line, isError));
         emulator.Exited += code => Dispatcher.UIThread.Post(() => OnEmulatorExited(code));
@@ -1472,6 +1564,7 @@ public partial class MainWindow : Window
             2 => "Exit.EbootNotFound",
             3 => "Exit.RuntimeException",
             4 => "Exit.EmulationError",
+            -1073741819 => "Exit.EmulationError",
             _ => "Exit.Unknown",
         };
         var meaning = Localization.Instance.Get(meaningKey);

src/SharpEmu.GUI/SharpEmu.GUI.csproj

@@ -10,6 +10,9 @@ SPDX-License-Identifier: GPL-2.0-or-later
   <PropertyGroup>
     <GenerateDocumentationFile>false</GenerateDocumentationFile>
     <Version>0.0.1</Version>
+    <!-- Required by the source-generated LibraryImport stubs in the linked
+         controller readers below. -->
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
   </PropertyGroup>
 
   <!-- Dependency-free; provides the BuildInfo provenance shown in the
@@ -28,6 +31,8 @@ SPDX-License-Identifier: GPL-2.0-or-later
 
   <ItemGroup>
     <AvaloniaResource Include="..\..\assets\images\SharpEmu.ico" Link="Assets/SharpEmu.ico" />
+    <AvaloniaResource Include="..\..\assets\images\github.png" Link="Assets/github.png" />
+    <AvaloniaResource Include="..\..\assets\images\discord.png" Link="Assets/discord.png" />
   </ItemGroup>
 
   <ItemGroup>
@@ -39,14 +44,14 @@ SPDX-License-Identifier: GPL-2.0-or-later
 
 
   <!-- The controller readers (DualSense raw HID + Xbox XInput) are shared
-       with the emulator's pad HLE. They are dependency-free, so they are
-       compiled in directly rather than pulling a reference to all of
-       SharpEmu.Libs into the launcher. -->
+       with the emulator's host input backend. They are dependency-free, so
+       they are compiled in directly rather than pulling a reference to all
+       of SharpEmu.HLE into the launcher. -->
   <ItemGroup>
-    <Compile Include="..\SharpEmu.Libs\Pad\PadState.cs" Link="Input/PadState.cs" />
-    <Compile Include="..\SharpEmu.Libs\Pad\HidNative.cs" Link="Input/HidNative.cs" />
-    <Compile Include="..\SharpEmu.Libs\Pad\DualSenseReader.cs" Link="Input/DualSenseReader.cs" />
-    <Compile Include="..\SharpEmu.Libs\Pad\XInputReader.cs" Link="Input/XInputReader.cs" />
+    <Compile Include="..\SharpEmu.HLE\Host\HostGamepadState.cs" Link="Input/HostGamepadState.cs" />
+    <Compile Include="..\SharpEmu.HLE\Host\Windows\WindowsHidNative.cs" Link="Input/WindowsHidNative.cs" />
+    <Compile Include="..\SharpEmu.HLE\Host\Windows\WindowsDualSenseReader.cs" Link="Input/WindowsDualSenseReader.cs" />
+    <Compile Include="..\SharpEmu.HLE\Host\Windows\WindowsXInputReader.cs" Link="Input/WindowsXInputReader.cs" />
   </ItemGroup>
 
 </Project>

src/SharpEmu.HLE/CpuContext.cs

@@ -1,6 +1,7 @@
 // Copyright (C) 2026 SharpEmu Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
+using System.Buffers;
 using System.Buffers.Binary;
 using System.Text;
 
@@ -238,23 +239,63 @@ public sealed class CpuContext(ICpuMemory memory, Generation generation)
             return false;
         }
 
-        var bytes = new byte[capacity];
-        for (var index = 0; index < bytes.Length; index++)
+        const int StackBufferLength = 512;
+        const int ReadChunkLength = 128;
+        var rented = capacity > StackBufferLength ? ArrayPool<byte>.Shared.Rent(capacity) : null;
+        Span<byte> bytes = rented is null ? stackalloc byte[StackBufferLength] : rented;
+        try
         {
-            if (!Memory.TryRead(address + (ulong)index, bytes.AsSpan(index, 1)))
+            var length = 0;
+            while (length < capacity)
             {
-                return false;
+                // Bulk-read in bounded chunks rather than the full capacity: the string
+                // may end just before unmapped memory, and overreading past the
+                // terminator by more than a chunk could fault where the old
+                // byte-by-byte loop succeeded.
+                var chunk = Math.Min(ReadChunkLength, capacity - length);
+                var span = bytes.Slice(length, chunk);
+                if (Memory.TryRead(address + (ulong)length, span))
+                {
+                    var terminator = span.IndexOf((byte)0);
+                    if (terminator >= 0)
+                    {
+                        value = Encoding.UTF8.GetString(bytes[..(length + terminator)]);
+                        return true;
+                    }
+
+                    length += chunk;
+                    continue;
+                }
+
+                // The chunk touches an unreadable range; fall back to per-byte reads so a
+                // terminator sitting before the bad byte still yields the string.
+                for (var i = 0; i < chunk; i++)
+                {
+                    if (!Memory.TryRead(address + (ulong)(length + i), bytes.Slice(length + i, 1)))
+                    {
+                        return false;
+                    }
+
+                    if (bytes[length + i] == 0)
+                    {
+                        value = Encoding.UTF8.GetString(bytes[..(length + i)]);
+                        return true;
+                    }
+                }
+
+                length += chunk;
             }
 
-            if (bytes[index] == 0)
+            value = Encoding.UTF8.GetString(bytes[..capacity]);
+            return true;
+        }
+        finally
+        {
+            if (rented is not null)
             {
-                value = Encoding.UTF8.GetString(bytes, 0, index);
-                return true;
+                ArrayPool<byte>.Shared.Return(rented);
             }
         }
-
-        value = Encoding.UTF8.GetString(bytes);
-        return true;
     }
 
     public bool PushUInt64(ulong value)

src/SharpEmu.HLE/GuestPageProtection.cs

@@ -0,0 +1,13 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE;
+
+[Flags]
+public enum GuestPageProtection
+{
+    None = 0,
+    Read = 1,
+    Write = 2,
+    Execute = 4,
+}

src/SharpEmu.HLE/GuestThreadExecution.cs

@@ -23,6 +23,20 @@ public readonly record struct GuestThreadSnapshot(
     ulong LastReturnRip,
     string? BlockReason);
 
+/// <summary>
+/// Continuation state for a blocked guest thread, replacing the closure pair a blocking
+/// wait used to allocate. TryWake runs under the scheduler's guest-thread gate and
+/// returns true when the waiter has a final result and the thread should be re-readied;
+/// false leaves it parked. Resume runs later on the woken thread outside that gate, and
+/// its return value becomes the guest's RAX for the resumed call.
+/// </summary>
+public interface IGuestThreadBlockWaiter
+{
+    int Resume();
+
+    bool TryWake();
+}
+
 public interface IGuestThreadScheduler
 {
     bool SupportsGuestContextTransfer { get; }
@@ -106,10 +120,7 @@ public static class GuestThreadExecution
     private static string? _pendingBlockWakeKey;
 
     [ThreadStatic]
-    private static Func<int>? _pendingBlockResumeHandler;
-
-    [ThreadStatic]
-    private static Func<bool>? _pendingBlockWakeHandler;
+    private static IGuestThreadBlockWaiter? _pendingBlockWaiter;
 
     [ThreadStatic]
     private static long _pendingBlockDeadlineTimestamp;
@@ -157,8 +168,7 @@ public static class GuestThreadExecution
         _pendingBlockContinuationValid = false;
         _pendingBlockContinuation = default;
         _pendingBlockWakeKey = null;
-        _pendingBlockResumeHandler = null;
-        _pendingBlockWakeHandler = null;
+        _pendingBlockWaiter = null;
         _pendingBlockDeadlineTimestamp = 0;
         _pendingEntryExit = false;
         _pendingEntryExitValue = 0;
@@ -179,8 +189,7 @@ public static class GuestThreadExecution
         _pendingBlockContinuationValid = false;
         _pendingBlockContinuation = default;
         _pendingBlockWakeKey = null;
-        _pendingBlockResumeHandler = null;
-        _pendingBlockWakeHandler = null;
+        _pendingBlockWaiter = null;
         _pendingBlockDeadlineTimestamp = 0;
         _pendingEntryExit = false;
         _pendingEntryExitValue = 0;
@@ -211,8 +220,7 @@ public static class GuestThreadExecution
         CpuContext? context,
         string reason,
         string? wakeKey = null,
-        Func<int>? resumeHandler = null,
-        Func<bool>? wakeHandler = null,
+        IGuestThreadBlockWaiter? waiter = null,
         long blockDeadlineTimestamp = 0)
     {
         if (!IsGuestThread)
@@ -222,8 +230,7 @@ public static class GuestThreadExecution
 
         _pendingBlockReason = string.IsNullOrWhiteSpace(reason) ? "guest_thread_blocked" : reason;
         _pendingBlockWakeKey = string.IsNullOrWhiteSpace(wakeKey) ? _pendingBlockReason : wakeKey;
-        _pendingBlockResumeHandler = resumeHandler;
-        _pendingBlockWakeHandler = wakeHandler;
+        _pendingBlockWaiter = waiter;
         _pendingBlockDeadlineTimestamp = blockDeadlineTimestamp;
         if (context is not null && TryCaptureCurrentBlockContinuation(context, out var continuation))
         {
@@ -255,7 +262,6 @@ public static class GuestThreadExecution
             out hasContinuation,
             out _,
             out _,
-            out _,
             out _);
     }
 
@@ -264,16 +270,14 @@ public static class GuestThreadExecution
         out GuestCpuContinuation continuation,
         out bool hasContinuation,
         out string wakeKey,
-        out Func<int>? resumeHandler,
-        out Func<bool>? wakeHandler)
+        out IGuestThreadBlockWaiter? waiter)
     {
         return TryConsumeCurrentThreadBlock(
             out reason,
             out continuation,
             out hasContinuation,
             out wakeKey,
-            out resumeHandler,
-            out wakeHandler,
+            out waiter,
             out _);
     }
 
@@ -282,8 +286,7 @@ public static class GuestThreadExecution
         out GuestCpuContinuation continuation,
         out bool hasContinuation,
         out string wakeKey,
-        out Func<int>? resumeHandler,
-        out Func<bool>? wakeHandler,
+        out IGuestThreadBlockWaiter? waiter,
         out long blockDeadlineTimestamp)
     {
         reason = _pendingBlockReason ?? string.Empty;
@@ -292,8 +295,7 @@ public static class GuestThreadExecution
             continuation = default;
             hasContinuation = false;
             wakeKey = string.Empty;
-            resumeHandler = null;
-            wakeHandler = null;
+            waiter = null;
             blockDeadlineTimestamp = 0;
             return false;
         }
@@ -301,15 +303,13 @@ public static class GuestThreadExecution
         continuation = _pendingBlockContinuation;
         hasContinuation = _pendingBlockContinuationValid;
         wakeKey = _pendingBlockWakeKey ?? reason;
-        resumeHandler = _pendingBlockResumeHandler;
-        wakeHandler = _pendingBlockWakeHandler;
+        waiter = _pendingBlockWaiter;
         blockDeadlineTimestamp = _pendingBlockDeadlineTimestamp;
         _pendingBlockReason = null;
         _pendingBlockContinuation = default;
         _pendingBlockContinuationValid = false;
         _pendingBlockWakeKey = null;
-        _pendingBlockResumeHandler = null;
-        _pendingBlockWakeHandler = null;
+        _pendingBlockWaiter = null;
         _pendingBlockDeadlineTimestamp = 0;
         return true;
     }

src/SharpEmu.HLE/Host/HostCapturedRegisters.cs

@@ -0,0 +1,18 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host;
+
+/// <summary>
+/// General-purpose register snapshot of a suspended thread, produced by
+/// <see cref="IHostThreading.TryCaptureThreadRegisters"/>. Registers are named
+/// after the guest ISA (x86-64), which every supported host executes natively.
+/// </summary>
+public readonly record struct HostCapturedRegisters(
+    ulong Rip,
+    ulong Rsp,
+    ulong Rbp,
+    ulong Rax,
+    ulong Rbx,
+    ulong Rcx,
+    ulong Rdx);

src/SharpEmu.HLE/Host/HostGamepadState.cs

@@ -0,0 +1,46 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host;
+
+/// <summary>
+/// Host-neutral gamepad button flags. Named after the PlayStation layout the guest API
+/// exposes, but the numeric values are the seam's own — the HLE pad exports translate
+/// them to SCE_PAD_BUTTON bits, so guest ABI values never leak into host backends.
+/// </summary>
+[Flags]
+public enum HostGamepadButtons : uint
+{
+    None = 0,
+    Up = 1 << 0,
+    Down = 1 << 1,
+    Left = 1 << 2,
+    Right = 1 << 3,
+    Cross = 1 << 4,
+    Circle = 1 << 5,
+    Square = 1 << 6,
+    Triangle = 1 << 7,
+    L1 = 1 << 8,
+    R1 = 1 << 9,
+    L2 = 1 << 10,
+    R2 = 1 << 11,
+    L3 = 1 << 12,
+    R3 = 1 << 13,
+    Options = 1 << 14,
+    TouchPad = 1 << 15,
+}
+
+/// <summary>
+/// Snapshot of one host gamepad: sticks are 0..255 with 128 centered and Y growing
+/// downward; triggers 0..255. Unmanaged on purpose so per-frame polls can stackalloc
+/// snapshot buffers.
+/// </summary>
+public readonly record struct HostGamepadState(
+    bool Connected,
+    HostGamepadButtons Buttons,
+    byte LeftX,
+    byte LeftY,
+    byte RightX,
+    byte RightY,
+    byte LeftTrigger,
+    byte RightTrigger);

src/SharpEmu.HLE/Host/HostPageProtection.cs

@@ -0,0 +1,20 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host;
+
+/// <summary>
+/// Platform-neutral page protection. Values intentionally enumerate the exact
+/// combinations the emulator uses today so each maps 1:1 onto a single native
+/// protection constant (PAGE_* on Windows, PROT_* elsewhere).
+/// </summary>
+public enum HostPageProtection
+{
+    NoAccess,
+    ReadOnly,
+    ReadWrite,
+    Execute,
+    ReadExecute,
+    ReadWriteExecute,
+    ExecuteWriteCopy,
+}

src/SharpEmu.HLE/Host/HostPlatform.cs

@@ -0,0 +1,34 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Runtime.InteropServices;
+using SharpEmu.HLE.Host.Windows;
+
+namespace SharpEmu.HLE.Host;
+
+/// <summary>
+/// Process-wide access point for the host platform backend. Static HLE export
+/// classes (which cannot receive constructor injection) resolve host primitives
+/// through <see cref="Current"/>; injectable components should instead accept an
+/// <see cref="IHostPlatform"/> and merely default to this.
+/// </summary>
+public static class HostPlatform
+{
+    private static readonly Lazy<IHostPlatform> Instance = new(Create);
+
+    public static IHostPlatform Current => Instance.Value;
+
+    private static IHostPlatform Create()
+    {
+        // The Windows backend executes guest x86-64 natively and emits x86-64
+        // stubs, so a native ARM64 process must be rejected here rather than
+        // crash undefined later (x64 processes under emulation report X64).
+        if (OperatingSystem.IsWindows() && RuntimeInformation.ProcessArchitecture == Architecture.X64)
+        {
+            return new WindowsHostPlatform();
+        }
+
+        throw new PlatformNotSupportedException(
+            "SharpEmu native guest execution requires a host platform backend and none exists for this OS/architecture yet (currently Windows x64 only).");
+    }
+}

src/SharpEmu.HLE/Host/HostRegionInfo.cs

@@ -0,0 +1,20 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host;
+
+/// <summary>
+/// Result of <see cref="IHostMemory.Query"/>. The Raw* fields carry the
+/// untranslated OS values so call sites migrated from direct VirtualQuery use
+/// keep comparing (and logging) the exact native words they did before;
+/// <see cref="State"/> and <see cref="Protection"/> are neutral views.
+/// </summary>
+public readonly record struct HostRegionInfo(
+    ulong BaseAddress,
+    ulong AllocationBase,
+    ulong RegionSize,
+    HostRegionState State,
+    uint RawState,
+    HostPageProtection Protection,
+    uint RawProtection,
+    uint RawAllocationProtection);

src/SharpEmu.HLE/Host/HostRegionState.cs

@@ -0,0 +1,11 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host;
+
+public enum HostRegionState
+{
+    Free,
+    Reserved,
+    Committed,
+}

src/SharpEmu.HLE/Host/HostRuntimeFunction.cs

@@ -0,0 +1,21 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host;
+
+/// <summary>
+/// Host functions whose addresses the execution engine bakes into emitted
+/// stubs (spin-waits, worker run loops, TLS reads). Enum-keyed rather than a
+/// free-form name lookup: each platform's emitters need their own specific
+/// functions, and this set is exactly what the current emitters consume.
+/// </summary>
+public enum HostRuntimeFunction
+{
+    TlsGetValue,
+    QueryPerformanceCounter,
+    SwitchToThread,
+    Sleep,
+    WaitForSingleObject,
+    SetEvent,
+    ExitThread,
+}

src/SharpEmu.HLE/Host/IHostAudioOutput.cs

@@ -0,0 +1,23 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host;
+
+/// <summary>
+/// Host audio-output device access. The HLE audio exports convert guest submissions to
+/// interleaved stereo 16-bit PCM (the format every backend accepts) and feed them through
+/// streams opened here; everything device-specific — queueing, backpressure, native
+/// buffer lifetime — lives behind <see cref="IHostAudioStream"/>.
+/// </summary>
+public interface IHostAudioOutput
+{
+    /// <summary>Backend identifier for diagnostics (e.g. "winmm").</summary>
+    string BackendName { get; }
+
+    /// <summary>
+    /// Opens an interleaved stereo 16-bit PCM output stream at the given sample rate.
+    /// Throws when the host has no usable output device; callers degrade to a silent
+    /// port and pace the guest instead.
+    /// </summary>
+    IHostAudioStream OpenStereoPcm16Stream(uint sampleRate);
+}

src/SharpEmu.HLE/Host/IHostAudioStream.cs

@@ -0,0 +1,18 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host;
+
+/// <summary>
+/// One open host audio output stream. Submissions are interleaved stereo 16-bit PCM at
+/// the sample rate the stream was opened with.
+/// </summary>
+public interface IHostAudioStream : IDisposable
+{
+    /// <summary>
+    /// Submits one buffer. May block briefly while the device drains its queue (this is
+    /// what paces the guest's audio loop); returns false when the stream cannot accept
+    /// audio, in which case the caller paces the guest itself.
+    /// </summary>
+    bool Submit(ReadOnlySpan<byte> stereoPcm16);
+}

src/SharpEmu.HLE/Host/IHostFaultHandling.cs

@@ -0,0 +1,32 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host;
+
+/// <summary>
+/// Installation mechanics for the process-wide fault interception the execution
+/// engine relies on to catch guest faults. Deliberately thin: the managed
+/// handlers keep receiving the platform's raw exception data, and the emitted
+/// pre-filter thunk is an opaque per-platform unit. Implementations live next
+/// to the execution backend (SharpEmu.Core), not behind HostPlatform.Current.
+/// </summary>
+public interface IHostFaultHandling
+{
+    /// <summary>
+    /// Emits the native thunk that wraps a managed fault handler: it pre-filters
+    /// exception codes that must never enter managed code and, when the fault
+    /// happened on a guest stack, switches to the host stack saved in
+    /// <paramref name="hostRspSwitchTlsSlot"/> before the call. Returns 0 on failure.
+    /// </summary>
+    nint CreateHandlerThunk(nint managedCallback, uint hostRspSwitchTlsSlot, nint tlsGetValueAddress);
+
+    void FreeThunk(nint thunk);
+
+    /// <summary>Installs a first-chance handler ahead of existing ones; returns a removal handle (0 on failure).</summary>
+    nint AddFirstChanceHandler(nint thunk);
+
+    void RemoveHandler(nint handle);
+
+    /// <summary>Installs the last-resort filter; pass 0 to clear.</summary>
+    void SetUnhandledFilter(nint thunk);
+}

src/SharpEmu.HLE/Host/IHostInput.cs

@@ -0,0 +1,44 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host;
+
+/// <summary>
+/// Host input devices: gamepad state snapshots, force-feedback/lightbar sinks, and the
+/// keyboard-fallback queries. Which physical readers exist (DualSense over raw HID,
+/// XInput, evdev, ...) is a backend detail; merge policy between devices and the
+/// keyboard lives in the HLE pad exports.
+/// </summary>
+public interface IHostInput
+{
+    /// <summary>Starts the background device readers once; safe to call repeatedly.</summary>
+    void EnsureStarted();
+
+    /// <summary>
+    /// Fills <paramref name="destination"/> with snapshots of currently connected
+    /// gamepads and returns how many were written (0 when none are connected).
+    /// </summary>
+    int GetGamepadStates(Span<HostGamepadState> destination);
+
+    /// <summary>Human-readable name of the first connected gamepad, or null.</summary>
+    string? DescribeConnectedGamepad();
+
+    /// <summary>Sets rumble on all connected gamepads; large = strong/left motor.</summary>
+    void SetRumble(byte largeMotor, byte smallMotor);
+
+    /// <summary>
+    /// Approximates per-trigger vibration on gamepads without independent trigger
+    /// actuators; null leaves that trigger's current value unchanged.
+    /// </summary>
+    void SetTriggerRumble(byte? leftTrigger, byte? rightTrigger);
+
+    void SetLightbar(byte red, byte green, byte blue);
+
+    void ResetLightbar();
+
+    /// <summary>True when a window of this process has keyboard focus.</summary>
+    bool IsHostWindowFocused();
+
+    /// <summary>Windows virtual-key code semantics; other backends translate.</summary>
+    bool IsKeyDown(int virtualKey);
+}

src/SharpEmu.HLE/Host/IHostMemory.cs

@@ -0,0 +1,48 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host;
+
+/// <summary>
+/// Host page-allocation primitives used by the native execution engine.
+/// Allocate/Reserve/Commit are deliberately separate members (rather than a
+/// flags parameter) so every call site maps 1:1 onto the exact native call it
+/// replaced, keeping the Windows behavior byte-for-byte identical.
+/// </summary>
+public interface IHostMemory
+{
+    /// <summary>
+    /// Reserves and commits pages in one step. <paramref name="desiredAddress"/> of 0
+    /// lets the OS choose the address. Returns the base address, or 0 on failure.
+    /// The OS may satisfy the request at a different address than desired; callers
+    /// that require an exact placement must check the result themselves.
+    /// </summary>
+    ulong Allocate(ulong desiredAddress, ulong size, HostPageProtection protection);
+
+    /// <summary>Reserves address space without committing pages (lazy regions).</summary>
+    ulong Reserve(ulong desiredAddress, ulong size, HostPageProtection protection);
+
+    /// <summary>Commits pages inside a previously reserved range (fault-path lazy commit).</summary>
+    bool Commit(ulong address, ulong size, HostPageProtection protection);
+
+    /// <summary>Releases an entire allocation or reservation by its base address.</summary>
+    bool Free(ulong address);
+
+    /// <summary>
+    /// Changes protection on committed pages. <paramref name="rawOldProtection"/> is the
+    /// untranslated previous OS protection value (see <see cref="HostRegionInfo.RawProtection"/>).
+    /// </summary>
+    bool Protect(ulong address, ulong size, HostPageProtection protection, out uint rawOldProtection);
+
+    /// <summary>
+    /// Restores a raw protection value previously returned by <see cref="Protect"/> or
+    /// <see cref="Query"/> on this same platform. Raw values are opaque to callers and
+    /// must never cross platforms; this exists so save/restore protection sequences
+    /// round-trip OS-specific modifier bits the neutral enum cannot represent.
+    /// </summary>
+    bool ProtectRaw(ulong address, ulong size, uint rawProtection, out uint rawOldProtection);
+
+    bool Query(ulong address, out HostRegionInfo info);
+
+    void FlushInstructionCache(ulong address, ulong size);
+}

src/SharpEmu.HLE/Host/IHostPlatform.cs

@@ -0,0 +1,23 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host;
+
+/// <summary>
+/// Aggregates the host-OS primitives the native execution engine depends on.
+/// Each supported platform provides one implementation; consumers reach the
+/// process-wide instance through <see cref="HostPlatform.Current"/> or accept
+/// one by injection.
+/// </summary>
+public interface IHostPlatform
+{
+    IHostMemory Memory { get; }
+
+    IHostThreading Threading { get; }
+
+    IHostSymbolResolver Symbols { get; }
+
+    IHostAudioOutput Audio { get; }
+
+    IHostInput Input { get; }
+}

src/SharpEmu.HLE/Host/IHostSymbolResolver.cs

@@ -0,0 +1,10 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host;
+
+public interface IHostSymbolResolver
+{
+    /// <summary>Returns the native address of the function, or 0 if unavailable.</summary>
+    nint GetAddress(HostRuntimeFunction function);
+}

src/SharpEmu.HLE/Host/IHostThreading.cs

@@ -0,0 +1,51 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host;
+
+/// <summary>
+/// Raw host thread and native-TLS primitives for the execution engine. Guest
+/// code must run on threads the CLR did not create (no managed frames below
+/// guest frames), so thread creation takes a native entry point and is not
+/// expressible with managed threads.
+/// </summary>
+public interface IHostThreading
+{
+    /// <summary>Allocates a native TLS slot; returns <see cref="uint.MaxValue"/> on failure.</summary>
+    uint AllocateTlsSlot();
+
+    bool FreeTlsSlot(uint slot);
+
+    bool SetTlsValue(uint slot, nint value);
+
+    nint GetTlsValue(uint slot);
+
+    uint CurrentThreadId { get; }
+
+    bool TrySetCurrentThreadAffinity(nuint affinityMask);
+
+    /// <summary>
+    /// Asks the OS for ~1 ms timed-wait granularity for the life of the process
+    /// (idempotent; best-effort). No-op on platforms whose default is already fine.
+    /// </summary>
+    void RequestTimerResolution();
+
+    /// <summary>
+    /// Creates a raw OS thread executing native code at <paramref name="entry"/> with
+    /// <paramref name="stackReserveBytes"/> of reserved (not committed) stack.
+    /// Returns the thread handle, or 0 on failure.
+    /// </summary>
+    nint CreateNativeThread(nint entry, nint parameter, nuint stackReserveBytes, out uint threadId);
+
+    /// <summary>Waits for the thread to exit; true when it did within the timeout.</summary>
+    bool WaitForThreadExit(nint threadHandle, uint timeoutMilliseconds);
+
+    void CloseThreadHandle(nint threadHandle);
+
+    /// <summary>
+    /// Suspends the thread, snapshots its general-purpose registers, and resumes it —
+    /// one indivisible operation (diagnostics only). The caller must not pass the
+    /// current thread. Returns false if the thread cannot be opened or suspended.
+    /// </summary>
+    bool TryCaptureThreadRegisters(uint threadId, out HostCapturedRegisters registers);
+}

src/SharpEmu.HLE/Host/Windows/WindowsDualSenseReader.cs

@@ -3,21 +3,21 @@
 
 using Microsoft.Win32.SafeHandles;
 
-namespace SharpEmu.Libs.Pad;
+namespace SharpEmu.HLE.Host.Windows;
 
 /// <summary>
 /// Reads a DualSense controller over raw HID on a background thread.
 /// Supports USB (input report 0x01) and Bluetooth (extended report 0x31,
 /// activated by requesting feature report 0x05), with hot-plug retry.
 /// </summary>
-internal static class DualSenseReader
+internal static class WindowsDualSenseReader
 {
     private const ushort SonyVendorId = 0x054C;
     private const ushort DualSenseProductId = 0x0CE6;
     private const ushort DualSenseEdgeProductId = 0x0DF2;
 
     private static readonly object Gate = new();
-    private static PadState _state;
+    private static HostGamepadState _state;
     private static bool _started;
 
     // Output (rumble/lightbar) state, all guarded by Gate.
@@ -37,6 +37,8 @@ internal static class DualSenseReader
     /// <summary>Starts the background reader once; safe to call repeatedly.</summary>
     internal static void EnsureStarted()
     {
+        // The GUI source-links this reader and calls it directly, without the
+        // host-platform resolution that otherwise guarantees Windows.
         if (!OperatingSystem.IsWindows())
         {
             return;
@@ -59,7 +61,7 @@ internal static class DualSenseReader
         }
     }
 
-    internal static bool TryGetState(out PadState state)
+    internal static bool TryGetState(out HostGamepadState state)
     {
         lock (Gate)
         {
@@ -69,7 +71,7 @@ internal static class DualSenseReader
         return state.Connected;
     }
 
-    private static void SetState(in PadState state)
+    private static void SetState(in HostGamepadState state)
     {
         lock (Gate)
         {
@@ -148,11 +150,11 @@ internal static class DualSenseReader
         {
             if (_outputStream is null)
             {
-                var handle = HidNative.CreateFile(
+                var handle = WindowsHidNative.CreateFile(
                     _devicePath,
-                    HidNative.GenericRead | HidNative.GenericWrite,
-                    HidNative.FileShareRead | HidNative.FileShareWrite,
-                    0, HidNative.OpenExisting, 0, 0);
+                    WindowsHidNative.GenericRead | WindowsHidNative.GenericWrite,
+                    WindowsHidNative.FileShareRead | WindowsHidNative.FileShareWrite,
+                    0, WindowsHidNative.OpenExisting, 0, 0);
                 if (handle.IsInvalid)
                 {
                     handle.Dispose();
@@ -262,7 +264,7 @@ internal static class DualSenseReader
                 // to the full 0x31 input report. Harmless over USB.
                 var feature = new byte[41];
                 feature[0] = 0x05;
-                _ = HidNative.HidD_GetFeature(handle, feature, feature.Length);
+                _ = WindowsHidNative.HidD_GetFeature(handle, feature, feature.Length);
 
                 if (!announcedConnect)
                 {
@@ -320,18 +322,18 @@ internal static class DualSenseReader
     private static SafeFileHandle? OpenDualSense(out string? devicePath)
     {
         devicePath = null;
-        foreach (var path in HidNative.EnumerateHidDevicePaths())
+        foreach (var path in WindowsHidNative.EnumerateHidDevicePaths())
         {
             // Open without access rights just to query VID/PID.
-            using var probe = HidNative.CreateFile(
-                path, 0, HidNative.FileShareRead | HidNative.FileShareWrite, 0, HidNative.OpenExisting, 0, 0);
+            using var probe = WindowsHidNative.CreateFile(
+                path, 0, WindowsHidNative.FileShareRead | WindowsHidNative.FileShareWrite, 0, WindowsHidNative.OpenExisting, 0, 0);
             if (probe.IsInvalid)
             {
                 continue;
             }
 
-            var attributes = new HidNative.HiddAttributes { Size = 12 };
-            if (!HidNative.HidD_GetAttributes(probe, ref attributes) ||
+            var attributes = new WindowsHidNative.HiddAttributes { Size = 12 };
+            if (!WindowsHidNative.HidD_GetAttributes(probe, ref attributes) ||
                 attributes.VendorId != SonyVendorId ||
                 (attributes.ProductId != DualSenseProductId && attributes.ProductId != DualSenseEdgeProductId))
             {
@@ -339,19 +341,19 @@ internal static class DualSenseReader
             }
 
             // Read+write so feature reports work; fall back to read-only.
-            var handle = HidNative.CreateFile(
+            var handle = WindowsHidNative.CreateFile(
                 path,
-                HidNative.GenericRead | HidNative.GenericWrite,
-                HidNative.FileShareRead | HidNative.FileShareWrite,
-                0, HidNative.OpenExisting, 0, 0);
+                WindowsHidNative.GenericRead | WindowsHidNative.GenericWrite,
+                WindowsHidNative.FileShareRead | WindowsHidNative.FileShareWrite,
+                0, WindowsHidNative.OpenExisting, 0, 0);
             if (handle.IsInvalid)
             {
                 handle.Dispose();
-                handle = HidNative.CreateFile(
+                handle = WindowsHidNative.CreateFile(
                     path,
-                    HidNative.GenericRead,
-                    HidNative.FileShareRead | HidNative.FileShareWrite,
-                    0, HidNative.OpenExisting, 0, 0);
+                    WindowsHidNative.GenericRead,
+                    WindowsHidNative.FileShareRead | WindowsHidNative.FileShareWrite,
+                    0, WindowsHidNative.OpenExisting, 0, 0);
             }
 
             if (!handle.IsInvalid)
@@ -366,7 +368,7 @@ internal static class DualSenseReader
         return null;
     }
 
-    private static bool TryParseReport(ReadOnlySpan<byte> report, out PadState state)
+    private static bool TryParseReport(ReadOnlySpan<byte> report, out HostGamepadState state)
     {
         // USB: report id 0x01, payload starts at [1].
         // Bluetooth extended: report id 0x31, sequence byte at [1], payload at [2].
@@ -395,43 +397,43 @@ internal static class DualSenseReader
         var buttons1 = report[offset + 8];
         var buttons2 = report[offset + 9];
 
-        uint buttons = 0;
-        buttons |= (buttons0 & 0x10) != 0 ? OrbisPadButton.Square : 0;
-        buttons |= (buttons0 & 0x20) != 0 ? OrbisPadButton.Cross : 0;
-        buttons |= (buttons0 & 0x40) != 0 ? OrbisPadButton.Circle : 0;
-        buttons |= (buttons0 & 0x80) != 0 ? OrbisPadButton.Triangle : 0;
+        var buttons = HostGamepadButtons.None;
+        buttons |= (buttons0 & 0x10) != 0 ? HostGamepadButtons.Square : 0;
+        buttons |= (buttons0 & 0x20) != 0 ? HostGamepadButtons.Cross : 0;
+        buttons |= (buttons0 & 0x40) != 0 ? HostGamepadButtons.Circle : 0;
+        buttons |= (buttons0 & 0x80) != 0 ? HostGamepadButtons.Triangle : 0;
         buttons |= HatToButtons(buttons0 & 0x0F);
-        buttons |= (buttons1 & 0x01) != 0 ? OrbisPadButton.L1 : 0;
-        buttons |= (buttons1 & 0x02) != 0 ? OrbisPadButton.R1 : 0;
-        buttons |= (buttons1 & 0x04) != 0 ? OrbisPadButton.L2 : 0;
-        buttons |= (buttons1 & 0x08) != 0 ? OrbisPadButton.R2 : 0;
-        buttons |= (buttons1 & 0x20) != 0 ? OrbisPadButton.Options : 0;
-        buttons |= (buttons1 & 0x40) != 0 ? OrbisPadButton.L3 : 0;
-        buttons |= (buttons1 & 0x80) != 0 ? OrbisPadButton.R3 : 0;
-        buttons |= (buttons2 & 0x02) != 0 ? OrbisPadButton.TouchPad : 0;
+        buttons |= (buttons1 & 0x01) != 0 ? HostGamepadButtons.L1 : 0;
+        buttons |= (buttons1 & 0x02) != 0 ? HostGamepadButtons.R1 : 0;
+        buttons |= (buttons1 & 0x04) != 0 ? HostGamepadButtons.L2 : 0;
+        buttons |= (buttons1 & 0x08) != 0 ? HostGamepadButtons.R2 : 0;
+        buttons |= (buttons1 & 0x20) != 0 ? HostGamepadButtons.Options : 0;
+        buttons |= (buttons1 & 0x40) != 0 ? HostGamepadButtons.L3 : 0;
+        buttons |= (buttons1 & 0x80) != 0 ? HostGamepadButtons.R3 : 0;
+        buttons |= (buttons2 & 0x02) != 0 ? HostGamepadButtons.TouchPad : 0;
 
-        state = new PadState(
+        state = new HostGamepadState(
             Connected: true,
             Buttons: buttons,
             LeftX: leftX,
             LeftY: leftY,
             RightX: rightX,
             RightY: rightY,
-            L2: l2,
-            R2: r2);
+            LeftTrigger: l2,
+            RightTrigger: r2);
         return true;
     }
 
-    private static uint HatToButtons(int hat) => hat switch
+    private static HostGamepadButtons HatToButtons(int hat) => hat switch
     {
-        0 => OrbisPadButton.Up,
-        1 => OrbisPadButton.Up | OrbisPadButton.Right,
-        2 => OrbisPadButton.Right,
-        3 => OrbisPadButton.Right | OrbisPadButton.Down,
-        4 => OrbisPadButton.Down,
-        5 => OrbisPadButton.Down | OrbisPadButton.Left,
-        6 => OrbisPadButton.Left,
-        7 => OrbisPadButton.Left | OrbisPadButton.Up,
+        0 => HostGamepadButtons.Up,
+        1 => HostGamepadButtons.Up | HostGamepadButtons.Right,
+        2 => HostGamepadButtons.Right,
+        3 => HostGamepadButtons.Right | HostGamepadButtons.Down,
+        4 => HostGamepadButtons.Down,
+        5 => HostGamepadButtons.Down | HostGamepadButtons.Left,
+        6 => HostGamepadButtons.Left,
+        7 => HostGamepadButtons.Left | HostGamepadButtons.Up,
         _ => 0,
     };
 }

src/SharpEmu.HLE/Host/Windows/WindowsHidNative.cs

@@ -4,13 +4,13 @@
 using System.Runtime.InteropServices;
 using Microsoft.Win32.SafeHandles;
 
-namespace SharpEmu.Libs.Pad;
+namespace SharpEmu.HLE.Host.Windows;
 
 /// <summary>
 /// Minimal Win32 HID interop used to talk to a DualSense controller
 /// directly, without any external input library.
 /// </summary>
-internal static partial class HidNative
+internal static partial class WindowsHidNative
 {
     internal const int DigcfPresent = 0x02;
     internal const int DigcfDeviceInterface = 0x10;
@@ -38,28 +38,32 @@ internal static partial class HidNative
         public ushort VersionNumber;
     }
 
-    [DllImport("hid.dll")]
-    internal static extern void HidD_GetHidGuid(out Guid hidGuid);
+    [LibraryImport("hid.dll")]
+    internal static partial void HidD_GetHidGuid(out Guid hidGuid);
 
-    [DllImport("hid.dll")]
-    internal static extern bool HidD_GetAttributes(SafeFileHandle hidDeviceObject, ref HiddAttributes attributes);
+    [LibraryImport("hid.dll")]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    internal static partial bool HidD_GetAttributes(SafeFileHandle hidDeviceObject, ref HiddAttributes attributes);
 
-    [DllImport("hid.dll")]
-    internal static extern bool HidD_GetFeature(SafeFileHandle hidDeviceObject, byte[] reportBuffer, int reportBufferLength);
+    [LibraryImport("hid.dll")]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    internal static partial bool HidD_GetFeature(SafeFileHandle hidDeviceObject, [In, Out] byte[] reportBuffer, int reportBufferLength);
 
-    [DllImport("setupapi.dll", CharSet = CharSet.Unicode)]
-    internal static extern nint SetupDiGetClassDevs(ref Guid classGuid, nint enumerator, nint hwndParent, int flags);
+    [LibraryImport("setupapi.dll", EntryPoint = "SetupDiGetClassDevsW")]
+    internal static partial nint SetupDiGetClassDevs(ref Guid classGuid, nint enumerator, nint hwndParent, int flags);
 
-    [DllImport("setupapi.dll")]
-    internal static extern bool SetupDiEnumDeviceInterfaces(
+    [LibraryImport("setupapi.dll")]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    internal static partial bool SetupDiEnumDeviceInterfaces(
         nint deviceInfoSet,
         nint deviceInfoData,
         ref Guid interfaceClassGuid,
         int memberIndex,
         ref SpDeviceInterfaceData deviceInterfaceData);
 
-    [DllImport("setupapi.dll", CharSet = CharSet.Unicode)]
-    internal static extern bool SetupDiGetDeviceInterfaceDetail(
+    [LibraryImport("setupapi.dll", EntryPoint = "SetupDiGetDeviceInterfaceDetailW")]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    internal static partial bool SetupDiGetDeviceInterfaceDetail(
         nint deviceInfoSet,
         ref SpDeviceInterfaceData deviceInterfaceData,
         nint deviceInterfaceDetailData,
@@ -67,11 +71,12 @@ internal static partial class HidNative
         out int requiredSize,
         nint deviceInfoData);
 
-    [DllImport("setupapi.dll")]
-    internal static extern bool SetupDiDestroyDeviceInfoList(nint deviceInfoSet);
+    [LibraryImport("setupapi.dll")]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    internal static partial bool SetupDiDestroyDeviceInfoList(nint deviceInfoSet);
 
-    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
-    internal static extern SafeFileHandle CreateFile(
+    [LibraryImport("kernel32.dll", EntryPoint = "CreateFileW", SetLastError = true, StringMarshalling = StringMarshalling.Utf16)]
+    internal static partial SafeFileHandle CreateFile(
         string fileName,
         uint desiredAccess,
         uint shareMode,

src/SharpEmu.HLE/Host/Windows/WindowsHostInput.cs

@@ -0,0 +1,84 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Runtime.InteropServices;
+
+namespace SharpEmu.HLE.Host.Windows;
+
+/// <summary>
+/// Windows input backend: DualSense over raw HID plus XInput controllers for gamepads,
+/// user32 for the keyboard-fallback queries. Rumble fans out to every reader; lightbar
+/// only exists on the DualSense.
+/// </summary>
+internal sealed partial class WindowsHostInput : IHostInput
+{
+    public void EnsureStarted()
+    {
+        WindowsDualSenseReader.EnsureStarted();
+        WindowsXInputReader.EnsureStarted();
+    }
+
+    public int GetGamepadStates(Span<HostGamepadState> destination)
+    {
+        var count = 0;
+        if (count < destination.Length && WindowsDualSenseReader.TryGetState(out var dualSense))
+        {
+            destination[count++] = dualSense;
+        }
+
+        if (count < destination.Length && WindowsXInputReader.TryGetState(out var xinput))
+        {
+            destination[count++] = xinput;
+        }
+
+        return count;
+    }
+
+    public string? DescribeConnectedGamepad()
+    {
+        if (WindowsDualSenseReader.TryGetState(out _))
+        {
+            return "DualSense";
+        }
+
+        return WindowsXInputReader.TryGetState(out _) ? "Xbox controller" : null;
+    }
+
+    public void SetRumble(byte largeMotor, byte smallMotor)
+    {
+        WindowsDualSenseReader.SetRumble(largeMotor, smallMotor);
+        WindowsXInputReader.SetRumble(largeMotor, smallMotor);
+    }
+
+    public void SetTriggerRumble(byte? leftTrigger, byte? rightTrigger) =>
+        WindowsXInputReader.SetTriggerRumble(leftTrigger, rightTrigger);
+
+    public void SetLightbar(byte red, byte green, byte blue) =>
+        WindowsDualSenseReader.SetLightbar(red, green, blue);
+
+    public void ResetLightbar() => WindowsDualSenseReader.ResetLightbar();
+
+    public bool IsHostWindowFocused()
+    {
+        var foregroundWindow = GetForegroundWindow();
+        if (foregroundWindow == 0)
+        {
+            return false;
+        }
+
+        GetWindowThreadProcessId(foregroundWindow, out var processId);
+        return processId == (uint)Environment.ProcessId;
+    }
+
+    public bool IsKeyDown(int virtualKey) =>
+        (GetAsyncKeyState(virtualKey) & 0x8000) != 0;
+
+    [LibraryImport("user32.dll")]
+    private static partial short GetAsyncKeyState(int vKey);
+
+    [LibraryImport("user32.dll")]
+    private static partial nint GetForegroundWindow();
+
+    [LibraryImport("user32.dll")]
+    private static partial uint GetWindowThreadProcessId(nint hWnd, out uint processId);
+}

src/SharpEmu.HLE/Host/Windows/WindowsHostMemory.cs

@@ -0,0 +1,153 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Runtime.InteropServices;
+
+namespace SharpEmu.HLE.Host.Windows;
+
+/// <summary>
+/// Windows implementation over VirtualAlloc/VirtualFree/VirtualProtect/VirtualQuery.
+/// Sealed so the JIT can devirtualize interface calls on fault-handling hot paths.
+/// </summary>
+internal sealed unsafe partial class WindowsHostMemory : IHostMemory
+{
+    private const uint MEM_COMMIT = 0x1000;
+    private const uint MEM_RESERVE = 0x2000;
+    private const uint MEM_RELEASE = 0x8000;
+    private const uint MEM_FREE = 0x10000;
+
+    private const uint PAGE_NOACCESS = 0x01;
+    private const uint PAGE_READONLY = 0x02;
+    private const uint PAGE_READWRITE = 0x04;
+    private const uint PAGE_WRITECOPY = 0x08;
+    private const uint PAGE_EXECUTE = 0x10;
+    private const uint PAGE_EXECUTE_READ = 0x20;
+    private const uint PAGE_EXECUTE_READWRITE = 0x40;
+    private const uint PAGE_EXECUTE_WRITECOPY = 0x80;
+
+    public ulong Allocate(ulong desiredAddress, ulong size, HostPageProtection protection)
+    {
+        return (ulong)VirtualAlloc((void*)desiredAddress, (nuint)size, MEM_COMMIT | MEM_RESERVE, ToNativeProtection(protection));
+    }
+
+    public ulong Reserve(ulong desiredAddress, ulong size, HostPageProtection protection)
+    {
+        return (ulong)VirtualAlloc((void*)desiredAddress, (nuint)size, MEM_RESERVE, ToNativeProtection(protection));
+    }
+
+    public bool Commit(ulong address, ulong size, HostPageProtection protection)
+    {
+        return VirtualAlloc((void*)address, (nuint)size, MEM_COMMIT, ToNativeProtection(protection)) != null;
+    }
+
+    public bool Free(ulong address)
+    {
+        return VirtualFree((void*)address, 0, MEM_RELEASE);
+    }
+
+    public bool Protect(ulong address, ulong size, HostPageProtection protection, out uint rawOldProtection)
+    {
+        return VirtualProtect((void*)address, (nuint)size, ToNativeProtection(protection), out rawOldProtection);
+    }
+
+    public bool ProtectRaw(ulong address, ulong size, uint rawProtection, out uint rawOldProtection)
+    {
+        return VirtualProtect((void*)address, (nuint)size, rawProtection, out rawOldProtection);
+    }
+
+    public bool Query(ulong address, out HostRegionInfo info)
+    {
+        if (VirtualQuery((void*)address, out var mbi, (nuint)sizeof(MemoryBasicInformation64)) == 0)
+        {
+            info = default;
+            return false;
+        }
+
+        info = new HostRegionInfo(
+            mbi.BaseAddress,
+            mbi.AllocationBase,
+            mbi.RegionSize,
+            ToRegionState(mbi.State),
+            mbi.State,
+            ToHostProtection(mbi.Protect),
+            mbi.Protect,
+            mbi.AllocationProtect);
+        return true;
+    }
+
+    public void FlushInstructionCache(ulong address, ulong size)
+    {
+        FlushInstructionCache(GetCurrentProcess(), (void*)address, (nuint)size);
+    }
+
+    private static uint ToNativeProtection(HostPageProtection protection) => protection switch
+    {
+        HostPageProtection.NoAccess => PAGE_NOACCESS,
+        HostPageProtection.ReadOnly => PAGE_READONLY,
+        HostPageProtection.ReadWrite => PAGE_READWRITE,
+        HostPageProtection.Execute => PAGE_EXECUTE,
+        HostPageProtection.ReadExecute => PAGE_EXECUTE_READ,
+        HostPageProtection.ReadWriteExecute => PAGE_EXECUTE_READWRITE,
+        HostPageProtection.ExecuteWriteCopy => PAGE_EXECUTE_WRITECOPY,
+        _ => throw new ArgumentOutOfRangeException(nameof(protection), protection, null),
+    };
+
+    private static HostRegionState ToRegionState(uint state) => state switch
+    {
+        MEM_COMMIT => HostRegionState.Committed,
+        MEM_RESERVE => HostRegionState.Reserved,
+        MEM_FREE => HostRegionState.Free,
+        _ => HostRegionState.Free,
+    };
+
+    private static HostPageProtection ToHostProtection(uint rawProtection)
+    {
+        // Strip PAGE_GUARD/PAGE_NOCACHE/PAGE_WRITECOMBINE modifiers; callers needing
+        // them compare HostRegionInfo.RawProtection directly.
+        return (rawProtection & 0xFF) switch
+        {
+            PAGE_READONLY => HostPageProtection.ReadOnly,
+            PAGE_READWRITE => HostPageProtection.ReadWrite,
+            PAGE_WRITECOPY => HostPageProtection.ReadWrite,
+            PAGE_EXECUTE => HostPageProtection.Execute,
+            PAGE_EXECUTE_READ => HostPageProtection.ReadExecute,
+            PAGE_EXECUTE_READWRITE => HostPageProtection.ReadWriteExecute,
+            PAGE_EXECUTE_WRITECOPY => HostPageProtection.ExecuteWriteCopy,
+            _ => HostPageProtection.NoAccess,
+        };
+    }
+
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    private static partial void* VirtualAlloc(void* lpAddress, nuint dwSize, uint flAllocationType, uint flProtect);
+
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static partial bool VirtualFree(void* lpAddress, nuint dwSize, uint dwFreeType);
+
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static partial bool VirtualProtect(void* lpAddress, nuint dwSize, uint flNewProtect, out uint lpflOldProtect);
+
+    [LibraryImport("kernel32.dll")]
+    private static partial nuint VirtualQuery(void* lpAddress, out MemoryBasicInformation64 lpBuffer, nuint dwLength);
+
+    [LibraryImport("kernel32.dll")]
+    private static partial void* GetCurrentProcess();
+
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static partial bool FlushInstructionCache(void* hProcess, void* lpBaseAddress, nuint dwSize);
+
+    private struct MemoryBasicInformation64
+    {
+        public ulong BaseAddress;
+        public ulong AllocationBase;
+        public uint AllocationProtect;
+        public uint Alignment1;
+        public ulong RegionSize;
+        public uint State;
+        public uint Protect;
+        public uint Type;
+        public uint Alignment2;
+    }
+}

src/SharpEmu.HLE/Host/Windows/WindowsHostPlatform.cs

@@ -0,0 +1,17 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host.Windows;
+
+internal sealed class WindowsHostPlatform : IHostPlatform
+{
+    public IHostMemory Memory { get; } = new WindowsHostMemory();
+
+    public IHostThreading Threading { get; } = new WindowsHostThreading();
+
+    public IHostSymbolResolver Symbols { get; } = new WindowsHostSymbolResolver();
+
+    public IHostAudioOutput Audio { get; } = new WindowsWaveOutAudio();
+
+    public IHostInput Input { get; } = new WindowsHostInput();
+}

src/SharpEmu.HLE/Host/Windows/WindowsHostSymbolResolver.cs

@@ -0,0 +1,39 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Runtime.InteropServices;
+
+namespace SharpEmu.HLE.Host.Windows;
+
+internal sealed partial class WindowsHostSymbolResolver : IHostSymbolResolver
+{
+    public nint GetAddress(HostRuntimeFunction function)
+    {
+        var kernel32 = GetModuleHandle("kernel32.dll");
+        if (kernel32 == 0)
+        {
+            return 0;
+        }
+
+        return GetProcAddress(kernel32, function switch
+        {
+            HostRuntimeFunction.TlsGetValue => "TlsGetValue",
+            HostRuntimeFunction.QueryPerformanceCounter => "QueryPerformanceCounter",
+            HostRuntimeFunction.SwitchToThread => "SwitchToThread",
+            HostRuntimeFunction.Sleep => "Sleep",
+            HostRuntimeFunction.WaitForSingleObject => "WaitForSingleObject",
+            HostRuntimeFunction.SetEvent => "SetEvent",
+            HostRuntimeFunction.ExitThread => "ExitThread",
+            _ => throw new ArgumentOutOfRangeException(nameof(function), function, null),
+        });
+    }
+
+    // Utf16 marshalling pins the managed string and passes its address directly
+    // (no copy); Utf8 stack-allocates the transient buffer for these short
+    // ASCII export names. LibraryImport is exact-spelling, hence the W entry point.
+    [LibraryImport("kernel32.dll", EntryPoint = "GetModuleHandleW", StringMarshalling = StringMarshalling.Utf16)]
+    private static partial nint GetModuleHandle(string lpModuleName);
+
+    [LibraryImport("kernel32.dll", StringMarshalling = StringMarshalling.Utf8)]
+    private static partial nint GetProcAddress(nint hModule, string procName);
+}

src/SharpEmu.HLE/Host/Windows/WindowsHostThreading.cs

@@ -0,0 +1,193 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Runtime.InteropServices;
+
+namespace SharpEmu.HLE.Host.Windows;
+
+internal sealed unsafe partial class WindowsHostThreading : IHostThreading
+{
+    private const uint StackSizeParamIsAReservation = 0x00010000u;
+    private const uint ThreadGetContext = 0x0008u;
+    private const uint ThreadSuspendResume = 0x0002u;
+
+    // Win64 CONTEXT layout (CONTROL | INTEGER only — no XMM state is requested).
+    private const int Win64ContextSize = 0x4D0;
+    private const int Win64ContextFlagsOffset = 0x30;
+    private const uint ContextAmd64ControlInteger = 0x00100003u;
+    private const int CtxRax = 120;
+    private const int CtxRcx = 128;
+    private const int CtxRdx = 136;
+    private const int CtxRbx = 144;
+    private const int CtxRsp = 152;
+    private const int CtxRbp = 160;
+    private const int CtxRip = 248;
+
+    private static int _timerResolutionRequested;
+
+    public void RequestTimerResolution()
+    {
+        if (Interlocked.Exchange(ref _timerResolutionRequested, 1) != 0)
+        {
+            return;
+        }
+
+        try
+        {
+            if (TimeBeginPeriod(1) != 0)
+            {
+                Console.Error.WriteLine(
+                    "[LOADER][WARN] Host timer resolution request rejected; " +
+                    "timed waits keep the default ~15.6 ms granularity.");
+            }
+        }
+        catch (DllNotFoundException exception)
+        {
+            Console.Error.WriteLine(
+                $"[LOADER][WARN] Host timer resolution unavailable: {exception.Message}");
+        }
+    }
+
+    public uint AllocateTlsSlot() => TlsAlloc();
+
+    public bool FreeTlsSlot(uint slot) => TlsFree(slot);
+
+    public bool SetTlsValue(uint slot, nint value) => TlsSetValue(slot, value);
+
+    public nint GetTlsValue(uint slot) => TlsGetValue(slot);
+
+    public uint CurrentThreadId => GetCurrentThreadId();
+
+    public bool TrySetCurrentThreadAffinity(nuint affinityMask)
+    {
+        return SetThreadAffinityMask(GetCurrentThread(), affinityMask) != 0;
+    }
+
+    public nint CreateNativeThread(nint entry, nint parameter, nuint stackReserveBytes, out uint threadId)
+    {
+        return CreateThread(0, stackReserveBytes, entry, parameter, StackSizeParamIsAReservation, out threadId);
+    }
+
+    public bool WaitForThreadExit(nint threadHandle, uint timeoutMilliseconds)
+    {
+        return WaitForSingleObject(threadHandle, timeoutMilliseconds) == 0u;
+    }
+
+    public void CloseThreadHandle(nint threadHandle)
+    {
+        _ = CloseHandle(threadHandle);
+    }
+
+    public bool TryCaptureThreadRegisters(uint threadId, out HostCapturedRegisters registers)
+    {
+        registers = default;
+        var threadHandle = OpenThread(ThreadGetContext | ThreadSuspendResume, false, threadId);
+        if (threadHandle == 0)
+        {
+            return false;
+        }
+
+        void* contextRecord = null;
+        var suspended = false;
+        try
+        {
+            if (SuspendThread(threadHandle) == uint.MaxValue)
+            {
+                return false;
+            }
+
+            suspended = true;
+            // CONTEXT requires 16-byte alignment (it embeds M128A fields);
+            // NativeMemory.AllocZeroed guarantees max_align_t, stackalloc only
+            // pointer-size — so this stays a native allocation.
+            contextRecord = NativeMemory.AllocZeroed((nuint)Win64ContextSize);
+            *(uint*)((byte*)contextRecord + Win64ContextFlagsOffset) = ContextAmd64ControlInteger;
+            if (!GetThreadContext(threadHandle, contextRecord))
+            {
+                return false;
+            }
+
+            registers = new HostCapturedRegisters(
+                ReadU64(contextRecord, CtxRip),
+                ReadU64(contextRecord, CtxRsp),
+                ReadU64(contextRecord, CtxRbp),
+                ReadU64(contextRecord, CtxRax),
+                ReadU64(contextRecord, CtxRbx),
+                ReadU64(contextRecord, CtxRcx),
+                ReadU64(contextRecord, CtxRdx));
+            return true;
+        }
+        finally
+        {
+            if (contextRecord != null)
+            {
+                NativeMemory.Free(contextRecord);
+            }
+            if (suspended)
+            {
+                _ = ResumeThread(threadHandle);
+            }
+            _ = CloseHandle(threadHandle);
+        }
+    }
+
+    private static ulong ReadU64(void* contextRecord, int offset)
+    {
+        return *(ulong*)((byte*)contextRecord + offset);
+    }
+
+    [LibraryImport("kernel32.dll")]
+    private static partial uint TlsAlloc();
+
+    [LibraryImport("kernel32.dll")]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static partial bool TlsFree(uint dwTlsIndex);
+
+    [LibraryImport("kernel32.dll")]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static partial bool TlsSetValue(uint dwTlsIndex, nint lpTlsValue);
+
+    [LibraryImport("kernel32.dll")]
+    private static partial nint TlsGetValue(uint dwTlsIndex);
+
+    [LibraryImport("kernel32.dll")]
+    private static partial uint GetCurrentThreadId();
+
+    [LibraryImport("kernel32.dll")]
+    private static partial nint GetCurrentThread();
+
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    private static partial nuint SetThreadAffinityMask(nint hThread, nuint dwThreadAffinityMask);
+
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    private static partial nint CreateThread(
+        nint lpThreadAttributes,
+        nuint dwStackSize,
+        nint lpStartAddress,
+        nint lpParameter,
+        uint dwCreationFlags,
+        out uint lpThreadId);
+
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    private static partial uint WaitForSingleObject(nint hHandle, uint dwMilliseconds);
+
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    private static partial nint OpenThread(uint dwDesiredAccess, [MarshalAs(UnmanagedType.Bool)] bool bInheritHandle, uint dwThreadId);
+
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    private static partial uint SuspendThread(nint hThread);
+
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    private static partial uint ResumeThread(nint hThread);
+
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static partial bool GetThreadContext(nint hThread, void* lpContext);
+
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static partial bool CloseHandle(nint hObject);
+
+    [LibraryImport("winmm.dll", EntryPoint = "timeBeginPeriod")]
+    private static partial uint TimeBeginPeriod(uint uPeriod);
+}

src/SharpEmu.HLE/Host/Windows/WindowsWaveOutAudio.cs

@@ -0,0 +1,243 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Runtime.InteropServices;
+
+namespace SharpEmu.HLE.Host.Windows;
+
+internal sealed partial class WindowsWaveOutAudio : IHostAudioOutput
+{
+    public string BackendName => "winmm";
+
+    public IHostAudioStream OpenStereoPcm16Stream(uint sampleRate) => new WaveOutStream(sampleRate);
+
+    private sealed partial class WaveOutStream : IHostAudioStream
+    {
+        private const uint WaveMapper = uint.MaxValue;
+        private const uint CallbackEvent = 0x0005_0000;
+        private const ushort WaveFormatPcm = 1;
+        private const uint WaveHeaderDone = 0x0000_0001;
+        private const int MaximumQueuedPcmBytes = 32 * 1024;
+
+        private readonly object _gate = new();
+        private readonly AutoResetEvent _completion = new(false);
+        private readonly Queue<NativeBuffer> _buffers = new();
+        private IntPtr _device;
+        private int _queuedPcmBytes;
+        private bool _disposed;
+
+        public WaveOutStream(uint sampleRate)
+        {
+            var format = new WaveFormat
+            {
+                FormatTag = WaveFormatPcm,
+                Channels = 2,
+                SamplesPerSecond = sampleRate,
+                AverageBytesPerSecond = checked(sampleRate * 4),
+                BlockAlign = 4,
+                BitsPerSample = 16,
+                ExtraSize = 0,
+            };
+            var result = WaveOutOpen(
+                out _device,
+                WaveMapper,
+                ref format,
+                _completion.SafeWaitHandle.DangerousGetHandle(),
+                IntPtr.Zero,
+                CallbackEvent);
+            if (result != 0)
+            {
+                throw new InvalidOperationException($"waveOutOpen failed with MMRESULT {result}.");
+            }
+        }
+
+        public bool Submit(ReadOnlySpan<byte> stereoPcm16)
+        {
+            lock (_gate)
+            {
+                if (_disposed)
+                {
+                    return false;
+                }
+
+                ReapCompletedBuffers();
+                while (_queuedPcmBytes != 0 &&
+                       _queuedPcmBytes + stereoPcm16.Length > MaximumQueuedPcmBytes)
+                {
+                    if (!_completion.WaitOne(TimeSpan.FromSeconds(1)))
+                    {
+                        return false;
+                    }
+
+                    ReapCompletedBuffers();
+                }
+
+                return QueueBuffer(stereoPcm16);
+            }
+        }
+
+        public void Dispose()
+        {
+            lock (_gate)
+            {
+                if (_disposed)
+                {
+                    return;
+                }
+
+                _disposed = true;
+                if (_device != IntPtr.Zero)
+                {
+                    WaveOutReset(_device);
+                    while (_buffers.TryDequeue(out var buffer))
+                    {
+                        ReleaseBuffer(buffer);
+                    }
+
+                    WaveOutClose(_device);
+                    _device = IntPtr.Zero;
+                }
+
+                _completion.Dispose();
+            }
+        }
+
+        private bool QueueBuffer(ReadOnlySpan<byte> data)
+        {
+            var dataAddress = Marshal.AllocHGlobal(data.Length);
+            var headerAddress = IntPtr.Zero;
+            try
+            {
+                unsafe
+                {
+                    data.CopyTo(new Span<byte>((void*)dataAddress, data.Length));
+                }
+
+                var header = new WaveHeader
+                {
+                    Data = dataAddress,
+                    BufferLength = checked((uint)data.Length),
+                };
+                headerAddress = Marshal.AllocHGlobal(Marshal.SizeOf<WaveHeader>());
+                Marshal.StructureToPtr(header, headerAddress, false);
+
+                var result = WaveOutPrepareHeader(
+                    _device,
+                    headerAddress,
+                    checked((uint)Marshal.SizeOf<WaveHeader>()));
+                if (result != 0)
+                {
+                    return false;
+                }
+
+                result = WaveOutWrite(
+                    _device,
+                    headerAddress,
+                    checked((uint)Marshal.SizeOf<WaveHeader>()));
+                if (result != 0)
+                {
+                    WaveOutUnprepareHeader(
+                        _device,
+                        headerAddress,
+                        checked((uint)Marshal.SizeOf<WaveHeader>()));
+                    return false;
+                }
+
+                _buffers.Enqueue(new NativeBuffer(dataAddress, headerAddress, data.Length));
+                _queuedPcmBytes += data.Length;
+                dataAddress = IntPtr.Zero;
+                headerAddress = IntPtr.Zero;
+                return true;
+            }
+            finally
+            {
+                if (headerAddress != IntPtr.Zero)
+                {
+                    Marshal.FreeHGlobal(headerAddress);
+                }
+
+                if (dataAddress != IntPtr.Zero)
+                {
+                    Marshal.FreeHGlobal(dataAddress);
+                }
+            }
+        }
+
+        private void ReapCompletedBuffers()
+        {
+            while (_buffers.TryPeek(out var buffer))
+            {
+                var header = Marshal.PtrToStructure<WaveHeader>(buffer.Header);
+                if ((header.Flags & WaveHeaderDone) == 0)
+                {
+                    return;
+                }
+
+                _buffers.Dequeue();
+                ReleaseBuffer(buffer);
+            }
+        }
+
+        private void ReleaseBuffer(NativeBuffer buffer)
+        {
+            WaveOutUnprepareHeader(
+                _device,
+                buffer.Header,
+                checked((uint)Marshal.SizeOf<WaveHeader>()));
+            _queuedPcmBytes -= buffer.Length;
+            Marshal.FreeHGlobal(buffer.Header);
+            Marshal.FreeHGlobal(buffer.Data);
+        }
+
+        private readonly record struct NativeBuffer(IntPtr Data, IntPtr Header, int Length);
+
+        [StructLayout(LayoutKind.Sequential, Pack = 2)]
+        private struct WaveFormat
+        {
+            public ushort FormatTag;
+            public ushort Channels;
+            public uint SamplesPerSecond;
+            public uint AverageBytesPerSecond;
+            public ushort BlockAlign;
+            public ushort BitsPerSample;
+            public ushort ExtraSize;
+        }
+
+        [StructLayout(LayoutKind.Sequential)]
+        private struct WaveHeader
+        {
+            public IntPtr Data;
+            public uint BufferLength;
+            public uint BytesRecorded;
+            public nuint User;
+            public uint Flags;
+            public uint Loops;
+            public IntPtr Next;
+            public nuint Reserved;
+        }
+
+        [LibraryImport("winmm.dll", EntryPoint = "waveOutOpen")]
+        private static partial uint WaveOutOpen(
+            out IntPtr device,
+            uint deviceId,
+            ref WaveFormat format,
+            IntPtr callback,
+            IntPtr instance,
+            uint flags);
+
+        [LibraryImport("winmm.dll", EntryPoint = "waveOutPrepareHeader")]
+        private static partial uint WaveOutPrepareHeader(IntPtr device, IntPtr header, uint headerSize);
+
+        [LibraryImport("winmm.dll", EntryPoint = "waveOutWrite")]
+        private static partial uint WaveOutWrite(IntPtr device, IntPtr header, uint headerSize);
+
+        [LibraryImport("winmm.dll", EntryPoint = "waveOutUnprepareHeader")]
+        private static partial uint WaveOutUnprepareHeader(IntPtr device, IntPtr header, uint headerSize);
+
+        [LibraryImport("winmm.dll", EntryPoint = "waveOutReset")]
+        private static partial uint WaveOutReset(IntPtr device);
+
+        [LibraryImport("winmm.dll", EntryPoint = "waveOutClose")]
+        private static partial uint WaveOutClose(IntPtr device);
+    }
+}

src/SharpEmu.HLE/Host/Windows/WindowsXInputReader.cs

@@ -3,15 +3,15 @@
 
 using System.Runtime.InteropServices;
 
-namespace SharpEmu.Libs.Pad;
+namespace SharpEmu.HLE.Host.Windows;
 
 /// <summary>
 /// Reads Xbox 360 / Xbox One (and other XInput-compatible) controllers via
-/// the Windows XInput API on a background thread, translated to the same
-/// ORBIS pad conventions as <see cref="DualSenseReader"/>. Supports rumble
-/// and hot-plug retry; the first connected slot (of four) is used.
+/// the Windows XInput API on a background thread, translated to
+/// <see cref="HostGamepadState"/> conventions. Supports rumble and hot-plug
+/// retry; the first connected slot (of four) is used.
 /// </summary>
-internal static class XInputReader
+internal static partial class WindowsXInputReader
 {
     private const uint ErrorSuccess = 0;
     private const int SlotCount = 4;
@@ -34,7 +34,7 @@ internal static class XInputReader
     private const ushort XinputY = 0x8000;
 
     private static readonly object Gate = new();
-    private static PadState _state;
+    private static HostGamepadState _state;
     private static bool _started;
     private static int _slot = -1; // connected XInput user index, -1 when none
     private static byte _motorLeft;
@@ -45,6 +45,8 @@ internal static class XInputReader
     /// <summary>Starts the background reader once; safe to call repeatedly.</summary>
     internal static void EnsureStarted()
     {
+        // The GUI source-links this reader and calls it directly, without the
+        // host-platform resolution that otherwise guarantees Windows.
         if (!OperatingSystem.IsWindows())
         {
             return;
@@ -67,7 +69,7 @@ internal static class XInputReader
         }
     }
 
-    internal static bool TryGetState(out PadState state)
+    internal static bool TryGetState(out HostGamepadState state)
     {
         lock (Gate)
         {
@@ -77,7 +79,7 @@ internal static class XInputReader
         return state.Connected;
     }
 
-    private static void SetState(in PadState state)
+    private static void SetState(in HostGamepadState state)
     {
         lock (Gate)
         {
@@ -204,40 +206,40 @@ internal static class XInputReader
         return -1;
     }
 
-    private static PadState Translate(in XInputGamepad pad)
+    private static HostGamepadState Translate(in XInputGamepad pad)
     {
-        uint buttons = 0;
-        buttons |= (pad.Buttons & XinputDpadUp) != 0 ? OrbisPadButton.Up : 0;
-        buttons |= (pad.Buttons & XinputDpadDown) != 0 ? OrbisPadButton.Down : 0;
-        buttons |= (pad.Buttons & XinputDpadLeft) != 0 ? OrbisPadButton.Left : 0;
-        buttons |= (pad.Buttons & XinputDpadRight) != 0 ? OrbisPadButton.Right : 0;
-        buttons |= (pad.Buttons & XinputStart) != 0 ? OrbisPadButton.Options : 0;
-        buttons |= (pad.Buttons & XinputBack) != 0 ? OrbisPadButton.TouchPad : 0;
-        buttons |= (pad.Buttons & XinputLeftThumb) != 0 ? OrbisPadButton.L3 : 0;
-        buttons |= (pad.Buttons & XinputRightThumb) != 0 ? OrbisPadButton.R3 : 0;
-        buttons |= (pad.Buttons & XinputLeftShoulder) != 0 ? OrbisPadButton.L1 : 0;
-        buttons |= (pad.Buttons & XinputRightShoulder) != 0 ? OrbisPadButton.R1 : 0;
-        buttons |= (pad.Buttons & XinputA) != 0 ? OrbisPadButton.Cross : 0;
-        buttons |= (pad.Buttons & XinputB) != 0 ? OrbisPadButton.Circle : 0;
-        buttons |= (pad.Buttons & XinputX) != 0 ? OrbisPadButton.Square : 0;
-        buttons |= (pad.Buttons & XinputY) != 0 ? OrbisPadButton.Triangle : 0;
-        buttons |= pad.LeftTrigger > TriggerThreshold ? OrbisPadButton.L2 : 0;
-        buttons |= pad.RightTrigger > TriggerThreshold ? OrbisPadButton.R2 : 0;
+        var buttons = HostGamepadButtons.None;
+        buttons |= (pad.Buttons & XinputDpadUp) != 0 ? HostGamepadButtons.Up : 0;
+        buttons |= (pad.Buttons & XinputDpadDown) != 0 ? HostGamepadButtons.Down : 0;
+        buttons |= (pad.Buttons & XinputDpadLeft) != 0 ? HostGamepadButtons.Left : 0;
+        buttons |= (pad.Buttons & XinputDpadRight) != 0 ? HostGamepadButtons.Right : 0;
+        buttons |= (pad.Buttons & XinputStart) != 0 ? HostGamepadButtons.Options : 0;
+        buttons |= (pad.Buttons & XinputBack) != 0 ? HostGamepadButtons.TouchPad : 0;
+        buttons |= (pad.Buttons & XinputLeftThumb) != 0 ? HostGamepadButtons.L3 : 0;
+        buttons |= (pad.Buttons & XinputRightThumb) != 0 ? HostGamepadButtons.R3 : 0;
+        buttons |= (pad.Buttons & XinputLeftShoulder) != 0 ? HostGamepadButtons.L1 : 0;
+        buttons |= (pad.Buttons & XinputRightShoulder) != 0 ? HostGamepadButtons.R1 : 0;
+        buttons |= (pad.Buttons & XinputA) != 0 ? HostGamepadButtons.Cross : 0;
+        buttons |= (pad.Buttons & XinputB) != 0 ? HostGamepadButtons.Circle : 0;
+        buttons |= (pad.Buttons & XinputX) != 0 ? HostGamepadButtons.Square : 0;
+        buttons |= (pad.Buttons & XinputY) != 0 ? HostGamepadButtons.Triangle : 0;
+        buttons |= pad.LeftTrigger > TriggerThreshold ? HostGamepadButtons.L2 : 0;
+        buttons |= pad.RightTrigger > TriggerThreshold ? HostGamepadButtons.R2 : 0;
 
-        return new PadState(
+        return new HostGamepadState(
             Connected: true,
             Buttons: buttons,
             LeftX: AxisToByte(pad.ThumbLX),
             LeftY: AxisToByteInverted(pad.ThumbLY),
             RightX: AxisToByte(pad.ThumbRX),
             RightY: AxisToByteInverted(pad.ThumbRY),
-            L2: pad.LeftTrigger,
-            R2: pad.RightTrigger);
+            LeftTrigger: pad.LeftTrigger,
+            RightTrigger: pad.RightTrigger);
     }
 
     private static byte AxisToByte(short value) => (byte)((value + 32768) >> 8);
 
-    // XInput Y grows upward, ORBIS pads report Y growing downward.
+    // XInput Y grows upward, host pad conventions report Y growing downward.
     private static byte AxisToByteInverted(short value) => (byte)(255 - ((value + 32768) >> 8));
 
     [StructLayout(LayoutKind.Sequential)]
@@ -267,9 +269,9 @@ internal static class XInputReader
     }
 
     // xinput1_4.dll ships with Windows 8 and later.
-    [DllImport("xinput1_4.dll")]
-    private static extern uint XInputGetState(uint userIndex, out XInputState state);
+    [LibraryImport("xinput1_4.dll")]
+    private static partial uint XInputGetState(uint userIndex, out XInputState state);
 
-    [DllImport("xinput1_4.dll")]
-    private static extern uint XInputSetState(uint userIndex, ref XInputVibration vibration);
+    [LibraryImport("xinput1_4.dll")]
+    private static partial uint XInputSetState(uint userIndex, ref XInputVibration vibration);
 }

src/SharpEmu.HLE/HostSessionControl.cs

@@ -0,0 +1,31 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE;
+
+/// <summary>
+/// Lets host-facing libraries (VideoOut, AudioOut) request cooperative guest
+/// shutdown without taking a dependency on SharpEmu.Core.
+/// </summary>
+public static class HostSessionControl
+{
+    private static Action<string>? _shutdownHandler;
+
+    public static void SetShutdownHandler(Action<string>? handler)
+    {
+        Volatile.Write(ref _shutdownHandler, handler);
+    }
+
+    public static void RequestShutdown(string reason)
+    {
+        try
+        {
+            Volatile.Read(ref _shutdownHandler)?.Invoke(reason);
+        }
+        catch (Exception exception)
+        {
+            Console.Error.WriteLine(
+                $"[LOADER][WARN] Host shutdown handler failed: {exception.Message}");
+        }
+    }
+}

src/SharpEmu.HLE/ICpuMemory.cs

@@ -8,4 +8,6 @@ public interface ICpuMemory
     bool TryRead(ulong virtualAddress, Span<byte> destination);
 
     bool TryWrite(ulong virtualAddress, ReadOnlySpan<byte> source);
+
+    bool TryCompare(ulong virtualAddress, ReadOnlySpan<byte> expected) => false;
 }

src/SharpEmu.HLE/ICpuMemoryWrapper.cs

@@ -0,0 +1,14 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE;
+
+/// <summary>
+/// Implemented by memories that decorate another <see cref="ICpuMemory"/>
+/// (e.g. access trackers) so capability lookups can unwrap to the real
+/// implementation without reflection.
+/// </summary>
+public interface ICpuMemoryWrapper
+{
+    ICpuMemory Inner { get; }
+}

src/SharpEmu.HLE/IGuestAddressSpace.cs

@@ -0,0 +1,21 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE;
+
+/// <summary>
+/// Guest address-space manipulation beyond plain allocation: fixed-address
+/// mapping and page-protection changes. Guest addresses are identity-mapped
+/// onto host pages by the implementing memory, so HLE exports (mmap, mprotect)
+/// reach these operations through <c>ctx.Memory</c> instead of calling host
+/// APIs directly. Member signatures deliberately mirror the implementation in
+/// SharpEmu.Core so existing call sites migrate call-for-call.
+/// </summary>
+public interface IGuestAddressSpace : IGuestMemoryAllocator
+{
+    ulong AllocateAt(ulong desiredAddress, ulong size, bool executable = true, bool allowAlternative = true);
+
+    bool TryAllocateAtOrAbove(ulong desiredAddress, ulong size, bool executable, ulong alignment, out ulong actualAddress);
+
+    bool TryProtect(ulong address, ulong size, GuestPageProtection protection);
+}

src/SharpEmu.HLE/IGuestMemoryAllocator.cs

@@ -6,4 +6,6 @@ namespace SharpEmu.HLE;
 public interface IGuestMemoryAllocator
 {
     bool TryAllocateGuestMemory(ulong size, ulong alignment, out ulong address);
+
+    bool TryFreeGuestMemory(ulong address);
 }

src/SharpEmu.Libs/Agc/AgcExports.cs

@@ -29,6 +29,7 @@ public static class AgcExports
     private const uint ItDispatchDirect = 0x15;
     private const uint ItDispatchIndirect = 0x16;
     private const uint ItWaitRegMem = 0x3C;
+    private const uint ItIndirectBuffer = 0x3F;
     private const uint ItEventWrite = 0x46;
     private const uint ItDmaData = 0x50;
     private const uint ItSetContextReg = 0x69;
@@ -157,7 +158,7 @@ public static class AgcExports
     private static readonly HashSet<uint> _tracedSubmittedDrawOpcodes = new();
     private static readonly Dictionary<(ulong Ps, ulong State, Gen5PixelOutputKind Output), byte[]> _pixelSpirvCache = new();
     private static readonly Dictionary<
-        (ulong Es, ulong EsState, ulong Ps, ulong PsState, Gen5PixelOutputKind Output),
+        (ulong Es, ulong EsState, ulong Ps, ulong PsState, string OutputLayout, uint Attributes),
         (byte[] Vertex, byte[] Pixel)> _graphicsSpirvCache = new();
     private static readonly Dictionary<
         (ulong Cs, ulong State, uint LocalX, uint LocalY, uint LocalZ),
@@ -1943,6 +1944,96 @@ public static class AgcExports
         return ReturnPointer(ctx, commandAddress);
     }
 
+    // Guest draw-command builders: emit valid (skippable) packets and return a live
+    // command pointer so the guest's command-buffer build succeeds; full draw processing is TODO.
+    [SysAbiExport(
+        Nid = "8N2tmT3jmC8",
+        ExportName = "sceAgcDcbSetIndexCount",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAgc")]
+    public static int DcbSetIndexCount(CpuContext ctx)
+    {
+        var dcb = ctx[CpuRegister.Rdi];
+        var indexCount = (uint)ctx[CpuRegister.Rsi];
+        if (dcb == 0)
+        {
+            return ReturnPointer(ctx, 0);
+        }
+
+        if (!TryAllocateCommandDwords(ctx, dcb, 2, out var cmd) ||
+            !ctx.TryWriteUInt32(cmd, Pm4(2, ItNop, RZero)) ||
+            !ctx.TryWriteUInt32(cmd + 4, indexCount))
+        {
+            return ReturnPointer(ctx, 0);
+        }
+
+        return ReturnPointer(ctx, cmd);
+    }
+
+    [SysAbiExport(
+        Nid = "xSAR0LTcRKM",
+        ExportName = "sceAgcDcbJump",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAgc")]
+    public static int DcbJump(CpuContext ctx)
+    {
+        var dcb = ctx[CpuRegister.Rdi];
+        var target = ctx[CpuRegister.Rsi];
+        var sizeDwords = (uint)ctx[CpuRegister.Rdx];
+        if (dcb == 0)
+        {
+            return ReturnPointer(ctx, 0);
+        }
+
+        if (!TryAllocateCommandDwords(ctx, dcb, 4, out var cmd) ||
+            !ctx.TryWriteUInt32(cmd, Pm4(4, ItIndirectBuffer, RZero)) ||
+            !ctx.TryWriteUInt32(cmd + 4, (uint)(target & 0xFFFF_FFFFUL)) ||
+            !ctx.TryWriteUInt32(cmd + 8, (uint)((target >> 32) & 0xFFFFUL)) ||
+            !ctx.TryWriteUInt32(cmd + 12, sizeDwords & 0xFFFFF))
+        {
+            return ReturnPointer(ctx, 0);
+        }
+
+        return ReturnPointer(ctx, cmd);
+    }
+
+    [SysAbiExport(
+        Nid = "bbFueFP+J4k",
+        ExportName = "sceAgcDcbSetPredication",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAgc")]
+    public static int DcbSetPredication(CpuContext ctx)
+    {
+        var dcb = ctx[CpuRegister.Rdi];
+        var address = ctx[CpuRegister.Rsi];
+        if (dcb == 0)
+        {
+            return ReturnPointer(ctx, 0);
+        }
+
+        if (!TryAllocateCommandDwords(ctx, dcb, 3, out var cmd) ||
+            !ctx.TryWriteUInt32(cmd, Pm4(3, ItNop, RZero)) ||
+            !ctx.TryWriteUInt32(cmd + 4, (uint)(address & 0xFFFF_FFFFUL)) ||
+            !ctx.TryWriteUInt32(cmd + 8, (uint)(address >> 32)))
+        {
+            return ReturnPointer(ctx, 0);
+        }
+
+        return ReturnPointer(ctx, cmd);
+    }
+
+    [SysAbiExport(
+        Nid = "w6Dj1VJt5qY",
+        ExportName = "sceAgcSetPacketPredication",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAgc")]
+    public static int SetPacketPredication(CpuContext ctx)
+    {
+        // Global predication toggle on a packet; a no-op is safe for rendering.
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
     [SysAbiExport(
         Nid = "w2rJhmD+dsE",
         ExportName = "sceAgcDriverAddEqEvent",
@@ -2019,8 +2110,16 @@ public static class AgcExports
         var gpuState = _submittedGpuStates.GetValue(ctx.Memory, static _ => new SubmittedGpuState());
         lock (gpuState.Gate)
         {
-            ParseSubmittedDcb(ctx, gpuState, gpuState.Graphics, commandAddress, dwordCount, tracePackets);
-            DrainResumableDcbs(ctx, gpuState, tracePackets);
+            Gen5ShaderScalarEvaluator.BeginGlobalMemoryReadScope();
+            try
+            {
+                ParseSubmittedDcb(ctx, gpuState, gpuState.Graphics, commandAddress, dwordCount, tracePackets);
+                DrainResumableDcbs(ctx, gpuState, tracePackets);
+            }
+            finally
+            {
+                Gen5ShaderScalarEvaluator.EndGlobalMemoryReadScope();
+            }
         }
 
         ctx[CpuRegister.Rax] = 0;
@@ -2050,27 +2149,35 @@ public static class AgcExports
         var gpuState = _submittedGpuStates.GetValue(ctx.Memory, static _ => new SubmittedGpuState());
         lock (gpuState.Gate)
         {
-            for (uint i = 0; i < bufferCount; i++)
+            Gen5ShaderScalarEvaluator.BeginGlobalMemoryReadScope();
+            try
             {
-                if (!ctx.TryReadUInt64(addressArray + i * 8, out var commandAddress) ||
-                    commandAddress == 0 ||
-                    !ctx.TryReadUInt32(sizeArray + i * 4, out var dwordCount) ||
-                    dwordCount == 0)
+                for (uint i = 0; i < bufferCount; i++)
                 {
-                    continue;
+                    if (!ctx.TryReadUInt64(addressArray + i * 8, out var commandAddress) ||
+                        commandAddress == 0 ||
+                        !ctx.TryReadUInt32(sizeArray + i * 4, out var dwordCount) ||
+                        dwordCount == 0)
+                    {
+                        continue;
+                    }
+
+                    if (tracePackets)
+                    {
+                        TraceAgc(
+                            $"agc.driver_submit_multi_dcbs index={i}/{bufferCount} " +
+                            $"addr=0x{commandAddress:X16} dwords={dwordCount}");
+                    }
+
+                    ParseSubmittedDcb(ctx, gpuState, gpuState.Graphics, commandAddress, dwordCount, tracePackets);
                 }
 
-                if (tracePackets)
-                {
-                    TraceAgc(
-                        $"agc.driver_submit_multi_dcbs index={i}/{bufferCount} " +
-                        $"addr=0x{commandAddress:X16} dwords={dwordCount}");
-                }
-
-                ParseSubmittedDcb(ctx, gpuState, gpuState.Graphics, commandAddress, dwordCount, tracePackets);
+                DrainResumableDcbs(ctx, gpuState, tracePackets);
+            }
+            finally
+            {
+                Gen5ShaderScalarEvaluator.EndGlobalMemoryReadScope();
             }
-
-            DrainResumableDcbs(ctx, gpuState, tracePackets);
         }
 
         ctx[CpuRegister.Rax] = 0;
@@ -2118,8 +2225,16 @@ public static class AgcExports
                 gpuState.ComputeQueues.Add(ownerHandle, queueState);
             }
 
-            ParseSubmittedDcb(ctx, gpuState, queueState, commandAddress, dwordCount, tracePackets);
-            DrainResumableDcbs(ctx, gpuState, tracePackets);
+            Gen5ShaderScalarEvaluator.BeginGlobalMemoryReadScope();
+            try
+            {
+                ParseSubmittedDcb(ctx, gpuState, queueState, commandAddress, dwordCount, tracePackets);
+                DrainResumableDcbs(ctx, gpuState, tracePackets);
+            }
+            finally
+            {
+                Gen5ShaderScalarEvaluator.EndGlobalMemoryReadScope();
+            }
         }
 
         ctx[CpuRegister.Rax] = 0;
@@ -3305,12 +3420,13 @@ public static class AgcExports
                     textures,
                     globalMemoryBuffers,
                     translatedDraw.AttributeCount,
-                    new VulkanGuestRenderTarget(
-                        firstTarget.Address,
-                        firstTarget.Width,
-                            firstTarget.Height,
-                            firstTarget.Format,
-                            firstTarget.NumberType),
+                    translatedDraw.RenderTargets.Select(target =>
+                        new VulkanGuestRenderTarget(
+                            target.Address,
+                            target.Width,
+                            target.Height,
+                            target.Format,
+                            target.NumberType)).ToArray(),
                         translatedDraw.VertexSpirv,
                         translatedDraw.VertexCount,
                         translatedDraw.InstanceCount,
@@ -3418,7 +3534,8 @@ public static class AgcExports
                 exportState,
                 out var exportEvaluation,
                 out error,
-                resolveVertexInputs: true) ||
+                resolveVertexInputs: true,
+                vertexRecordLimit: indexed ? null : vertexCount) ||
             !Gen5ShaderTranslator.TryCreateState(
                 ctx,
                 pixelShaderAddress,
@@ -3437,19 +3554,47 @@ public static class AgcExports
         }
 
         var renderTargets = GetRenderTargets(state.CxRegisters)
-            .Where(target =>
-                target.Slot == 0 &&
-                HasPixelColorExport(pixelState, target.Slot))
+            .Where(target => HasPixelColorExport(pixelState, target.Slot))
+            .OrderBy(target => target.Slot)
             .ToArray();
-        var outputKind = GetPixelOutputKind(renderTargets.FirstOrDefault().NumberType);
-        var exportStateFingerprint = ComputeShaderStateFingerprint(exportEvaluation);
-        var pixelStateFingerprint = ComputeShaderStateFingerprint(pixelEvaluation);
+        var renderTargetFormats = new VulkanRenderTargetFormat[renderTargets.Length];
+        for (var index = 0; index < renderTargets.Length; index++)
+        {
+            var target = renderTargets[index];
+            if (!VulkanVideoPresenter.TryDecodeRenderTargetFormat(
+                    target.Format,
+                    target.NumberType,
+                    out renderTargetFormats[index]))
+            {
+                error =
+                    $"unsupported color target format={target.Format} number_type={target.NumberType}";
+                return false;
+            }
+        }
+
+        var pixelOutputs = renderTargets
+            .Select((target, location) => new Gen5PixelOutputBinding(
+                target.Slot,
+                (uint)location,
+                renderTargetFormats[location].OutputKind))
+            .ToArray();
+        var outputLayout = string.Join(
+            ';',
+            pixelOutputs.Select(output =>
+                $"{output.GuestSlot}:{output.HostLocation}:{(int)output.Kind}"));
+        var attributeCount = GetInterpolatedAttributeCount(pixelState);
+        var exportStateFingerprint = ComputeShaderStructureFingerprint(exportEvaluation);
+        var pixelStateFingerprint = ComputeShaderStructureFingerprint(pixelEvaluation);
         var shaderKey = (
             exportShaderAddress,
             exportStateFingerprint,
             pixelShaderAddress,
             pixelStateFingerprint,
-            outputKind);
+            outputLayout,
+            attributeCount);
+        var totalGlobalBuffers =
+            pixelEvaluation.GlobalMemoryBindings.Count +
+            exportEvaluation.GlobalMemoryBindings.Count;
         (byte[] Vertex, byte[] Pixel) compiled;
         lock (_submitTraceGate)
         {
@@ -3458,26 +3603,25 @@ public static class AgcExports
 
         if (compiled.Vertex is null || compiled.Pixel is null)
         {
-            var totalGlobalBuffers =
-                pixelEvaluation.GlobalMemoryBindings.Count +
-                exportEvaluation.GlobalMemoryBindings.Count;
             if (!Gen5SpirvTranslator.TryCompilePixelShader(
                     pixelState,
                     pixelEvaluation,
-                    outputKind,
+                    pixelOutputs,
                     out var pixelShader,
                     out error,
                     globalBufferBase: 0,
-                    totalGlobalBufferCount: totalGlobalBuffers,
-                    imageBindingBase: 0) ||
+                    totalGlobalBufferCount: totalGlobalBuffers + 2,
+                    imageBindingBase: 0,
+                    scalarRegisterBufferIndex: totalGlobalBuffers) ||
                 !Gen5SpirvTranslator.TryCompileVertexShader(
                     exportState,
                     exportEvaluation,
                     out var vertexShader,
                     out error,
                     globalBufferBase: pixelEvaluation.GlobalMemoryBindings.Count,
-                    totalGlobalBufferCount: totalGlobalBuffers,
-                    imageBindingBase: pixelEvaluation.ImageBindings.Count))
+                    totalGlobalBufferCount: totalGlobalBuffers + 2,
+                    imageBindingBase: pixelEvaluation.ImageBindings.Count,
+                    scalarRegisterBufferIndex: totalGlobalBuffers + 1))
             {
                 return false;
             }
@@ -3529,6 +3673,8 @@ public static class AgcExports
 
         var globalMemoryBindings = pixelEvaluation.GlobalMemoryBindings
             .Concat(exportEvaluation.GlobalMemoryBindings)
+            .Append(CreateScalarRegisterBinding(pixelEvaluation))
+            .Append(CreateScalarRegisterBinding(exportEvaluation))
             .ToArray();
         IReadOnlyList<Gen5VertexInputBinding> vertexInputs =
             exportEvaluation.VertexInputs ?? [];
@@ -3539,7 +3685,7 @@ public static class AgcExports
             primitiveType,
             compiled.Vertex,
             compiled.Pixel,
-            GetInterpolatedAttributeCount(pixelState),
+            attributeCount,
             vertexCount,
             state.InstanceCount,
             indexed ? CreateVulkanIndexBuffer(ctx, state, vertexCount) : null,
@@ -3548,7 +3694,7 @@ public static class AgcExports
             vertexInputs,
             renderTargets,
             ApplyTransparentPremultipliedFillClear(
-                CreateRenderState(state.CxRegisters, renderTargets.FirstOrDefault()),
+                CreateRenderState(state.CxRegisters, renderTargets, pixelState),
                 textures,
                 vertexInputs,
                 pixelEvaluation.InitialScalarRegisters));
@@ -3564,7 +3710,8 @@ public static class AgcExports
     /// Chowdren resets its effect layers with an untextured transparent-black
     /// fill using premultiplied blending. With One/OneMinusSrcAlpha that draw
     /// is otherwise a no-op, causing fog and vignette layers to accumulate.
-    /// Treat precisely that draw shape as an overwrite.
+    /// Treat precisely that draw shape as an overwrite only when every MRT
+    /// attachment uses the same premultiplied blend pattern.
     /// </summary>
     private static VulkanGuestRenderState ApplyTransparentPremultipliedFillClear(
         VulkanGuestRenderState renderState,
@@ -3576,13 +3723,7 @@ public static class AgcExports
             textures.Count != 0 ||
             vertexInputs.Count != 0 ||
             pixelUserData.Count < 4 ||
-            renderState.Blend is not
-            {
-                Enable: true,
-                ColorSrcFactor: 1,
-                ColorDstFactor: 5,
-                ColorFunc: 0,
-            })
+            !renderState.Blends.All(IsTransparentPremultipliedFillBlend))
         {
             return renderState;
         }
@@ -3597,10 +3738,21 @@ public static class AgcExports
 
         return renderState with
         {
-            Blend = renderState.Blend with { Enable = false },
+            Blends = renderState.Blends
+                .Select(blend => blend with { Enable = false })
+                .ToArray(),
         };
     }
 
+    private static bool IsTransparentPremultipliedFillBlend(VulkanGuestBlendState blend) =>
+        blend is
+        {
+            Enable: true,
+            ColorSrcFactor: 1,
+            ColorDstFactor: 5,
+            ColorFunc: 0,
+        };
+
     private static VulkanGuestIndexBuffer? CreateVulkanIndexBuffer(
         CpuContext ctx,
         SubmittedDcbState state,
@@ -3623,19 +3775,15 @@ public static class AgcExports
             : null;
     }
 
-    private static Gen5PixelOutputKind GetPixelOutputKind(uint numberType) =>
-        numberType switch
-        {
-            4 => Gen5PixelOutputKind.Uint,
-            5 => Gen5PixelOutputKind.Sint,
-            _ => Gen5PixelOutputKind.Float,
-        };
-
     private static bool HasPixelColorExport(Gen5ShaderState state, uint target) =>
-        state.Program.Instructions.Any(instruction =>
-            instruction.Control is Gen5ExportControl export &&
-            export.Target == target &&
-            export.EnableMask != 0);
+        GetPixelColorExportMask(state, target) != 0;
+
+    private static uint GetPixelColorExportMask(Gen5ShaderState state, uint target) =>
+        state.Program.Instructions
+            .Select(instruction => instruction.Control)
+            .OfType<Gen5ExportControl>()
+            .Where(export => export.Target == target)
+            .Aggregate(0u, (mask, export) => mask | (export.EnableMask & 0xFu));
 
     private static uint GetInterpolatedAttributeCount(Gen5ShaderState state)
     {
@@ -3651,6 +3799,88 @@ public static class AgcExports
         return (uint)(maxAttribute + 1);
     }
 
+    private const int ShaderScalarRegisterCount = 256;
+
+    private static Gen5GlobalMemoryBinding CreateScalarRegisterBinding(
+        Gen5ShaderEvaluation evaluation)
+    {
+        var data = new byte[ShaderScalarRegisterCount * sizeof(uint)];
+        var registers = evaluation.InitialScalarRegisters;
+        var count = Math.Min(registers.Count, ShaderScalarRegisterCount);
+        for (var index = 0; index < count; index++)
+        {
+            var value = registers[index];
+            var offset = index * sizeof(uint);
+            data[offset] = (byte)value;
+            data[offset + 1] = (byte)(value >> 8);
+            data[offset + 2] = (byte)(value >> 16);
+            data[offset + 3] = (byte)(value >> 24);
+        }
+
+        return new Gen5GlobalMemoryBinding(0, 0, [], data);
+    }
+
+    private static ulong ComputeShaderStructureFingerprint(Gen5ShaderEvaluation evaluation)
+    {
+        const ulong offsetBasis = 14695981039346656037UL;
+        const ulong prime = 1099511628211UL;
+        var hash = offsetBasis;
+        void Mix(ulong value) => hash = (hash ^ value) * prime;
+
+        Mix((ulong)evaluation.GlobalMemoryBindings.Count);
+        foreach (var binding in evaluation.GlobalMemoryBindings)
+        {
+            Mix(binding.ScalarAddress);
+            Mix((ulong)binding.InstructionPcs.Count);
+            foreach (var pc in binding.InstructionPcs)
+            {
+                Mix(pc);
+            }
+        }
+
+        Mix((ulong)evaluation.ImageBindings.Count);
+        foreach (var image in evaluation.ImageBindings)
+        {
+            Mix(image.Pc);
+            Mix((ulong)(uint)image.Opcode.GetHashCode());
+            foreach (var word in image.ResourceDescriptor)
+            {
+                Mix(word);
+            }
+
+            foreach (var word in image.SamplerDescriptor)
+            {
+                Mix(word);
+            }
+
+            Mix(image.MipLevel ?? uint.MaxValue);
+        }
+
+        if (evaluation.VertexInputs is { } vertexInputs)
+        {
+            Mix((ulong)vertexInputs.Count);
+            foreach (var input in vertexInputs)
+            {
+                Mix(input.Pc);
+                Mix(input.Location);
+                Mix(input.ComponentCount);
+                Mix(input.DataFormat);
+                Mix(input.NumberFormat);
+                Mix(input.Stride);
+            }
+        }
+
+        if (evaluation.ComputeSystemRegisters is { } computeSystemRegisters)
+        {
+            Mix(computeSystemRegisters.WorkGroupXRegister ?? uint.MaxValue);
+            Mix(computeSystemRegisters.WorkGroupYRegister ?? uint.MaxValue);
+            Mix(computeSystemRegisters.WorkGroupZRegister ?? uint.MaxValue);
+            Mix(computeSystemRegisters.ThreadGroupSizeRegister ?? uint.MaxValue);
+        }
+
+        return hash;
+    }
+
     private static ulong ComputeShaderStateFingerprint(Gen5ShaderEvaluation evaluation)
     {
         const ulong offsetBasis = 14695981039346656037UL;
@@ -3711,11 +3941,25 @@ public static class AgcExports
 
     private static VulkanGuestRenderState CreateRenderState(
         IReadOnlyDictionary<uint, uint> registers,
-        RenderTargetDescriptor target)
+        IReadOnlyList<RenderTargetDescriptor> targets,
+        Gen5ShaderState pixelState)
     {
+        if (targets.Count == 0)
+        {
+            return VulkanGuestRenderState.Default;
+        }
+
+        var target = targets[0];
         var scissor = DecodeScissor(registers, target.Width, target.Height);
         return new VulkanGuestRenderState(
-            DecodeBlendState(registers, target.Slot),
+            targets.Select(target =>
+            {
+                var blend = DecodeBlendState(registers, target.Slot);
+                return blend with
+                {
+                    WriteMask = blend.WriteMask & GetPixelColorExportMask(pixelState, target.Slot),
+                };
+            }).ToArray(),
             scissor,
             DecodeViewport(registers, target.Width, target.Height, scissor));
     }
@@ -3740,7 +3984,7 @@ public static class AgcExports
             (control >> 24) & 0x1Fu,
             (control >> 21) & 0x7u,
             ((control >> 29) & 1u) != 0,
-            writeMask == 0 ? 0xFu : writeMask);
+            writeMask);
     }
 
     private static VulkanGuestRect? DecodeScissor(
@@ -5078,7 +5322,7 @@ public static class AgcExports
                         if (Gen5SpirvTranslator.TryCompilePixelShader(
                                  pixelState,
                                  evaluation,
-                                 Gen5PixelOutputKind.Float,
+                                 [new(0, 0, Gen5PixelOutputKind.Float)],
                                  out var compiledPixel,
                                  out var compileError))
                         {

src/SharpEmu.Libs/Agc/Gen5ShaderIr.cs

@@ -49,6 +49,11 @@ internal enum Gen5PixelOutputKind
     Sint,
 }
 
+internal readonly record struct Gen5PixelOutputBinding(
+    uint GuestSlot,
+    uint HostLocation,
+    Gen5PixelOutputKind Kind);
+
 internal enum Gen5SpirvStage
 {
     Vertex,

src/SharpEmu.Libs/Agc/Gen5ShaderScalarEvaluator.cs

@@ -13,6 +13,24 @@ internal static class Gen5ShaderScalarEvaluator
     private const int ImageDescriptorDwords = 8;
     private const int SamplerDescriptorDwords = 4;
     private const int MaxGlobalMemoryBindingBytes = 16 * 1024 * 1024;
+    private static readonly int DefaultGlobalMemoryBindingBytes =
+        int.TryParse(
+            Environment.GetEnvironmentVariable("SHARPEMU_GLOBAL_BINDING_BYTES"),
+            out var configured) && configured >= sizeof(uint)
+            ? Math.Min(configured, MaxGlobalMemoryBindingBytes)
+            : 1 * 1024 * 1024;
+
+    internal static long GlobalMemoryReadCount;
+    internal static long GlobalMemoryReadBytes;
+    internal static long GlobalMemoryReadCacheHits;
+    internal static long GlobalMemoryReadPvmBytes;
+    internal static long GlobalMemoryReadLibcBytes;
+    internal static long GlobalMemoryReadReuses;
+
+    private const long CrossFrameReadCacheMaxBytes = 1024L * 1024 * 1024;
+    private static readonly object _crossFrameReadGate = new();
+    private static readonly Dictionary<(ulong BaseAddress, int SizeBytes), byte[]> _crossFrameReadCache = new();
+    private static long _crossFrameReadCacheBytes;
     private const ulong RdnaWaveMask = 0xFFFF_FFFFUL;
 
     private readonly record struct BufferDescriptor(
@@ -44,7 +62,8 @@ internal static class Gen5ShaderScalarEvaluator
         Gen5ShaderState state,
         out Gen5ShaderEvaluation evaluation,
         out string error,
-        bool resolveVertexInputs = false)
+        bool resolveVertexInputs = false,
+        uint? vertexRecordLimit = null)
     {
         evaluation = default!;
         error = string.Empty;
@@ -255,10 +274,28 @@ internal static class Gen5ShaderScalarEvaluator
                 if (resolveVertexInputs &&
                     IsVertexFetchCandidate(instruction, bufferMemory, bufferDescriptor))
                 {
+                    var vertexReadSize = bufferDescriptor.SizeBytes;
+                    if (vertexRecordLimit is { } recordLimit &&
+                        instruction.Sources.Count > 2 &&
+                        TryEvaluateScalarOperand(
+                            instruction.Sources[2],
+                            scalarRegisters,
+                            out var scalarOffset))
+                    {
+                        var bindingOffset = unchecked((uint)bufferMemory.OffsetBytes + scalarOffset);
+                        var requiredBytes =
+                            (ulong)bindingOffset +
+                            (ulong)(Math.Max(recordLimit, 1u) - 1u) * bufferDescriptor.Stride +
+                            (ulong)bufferMemory.DwordCount * sizeof(uint);
+                        vertexReadSize = Math.Min(
+                            bufferDescriptor.SizeBytes,
+                            Math.Max(requiredBytes, sizeof(uint)));
+                    }
+
                     if (!TryReadGlobalMemory(
                             ctx,
                             bufferDescriptor.BaseAddress,
-                            bufferDescriptor.SizeBytes,
+                            vertexReadSize,
                             out var vertexData))
                     {
                         error =
@@ -533,22 +570,29 @@ internal static class Gen5ShaderScalarEvaluator
         return false;
     }
 
+    [ThreadStatic]
+    private static Dictionary<(ulong BaseAddress, int SizeBytes), byte[]>? _globalMemoryReadCache;
+
+    internal static void BeginGlobalMemoryReadScope()
+    {
+        _globalMemoryReadCache = new Dictionary<(ulong, int), byte[]>();
+    }
+
+    internal static void EndGlobalMemoryReadScope()
+    {
+        _globalMemoryReadCache = null;
+    }
+
     private static bool TryReadGlobalMemory(
         CpuContext ctx,
         ulong baseAddress,
         out byte[] data)
     {
-        for (var size = MaxGlobalMemoryBindingBytes; size >= 4096; size >>= 1)
-        {
-            data = GC.AllocateUninitializedArray<byte>(size);
-            if (ctx.Memory.TryRead(baseAddress, data))
-            {
-                return true;
-            }
-        }
-
-        data = [];
-        return false;
+        return TryReadGlobalMemory(
+            ctx,
+            baseAddress,
+            (ulong)DefaultGlobalMemoryBindingBytes,
+            out data);
     }
 
     private static bool TryReadGlobalMemory(
@@ -570,13 +614,74 @@ internal static class Gen5ShaderScalarEvaluator
             return false;
         }
 
+        var cache = _globalMemoryReadCache;
+        var cacheKey = (baseAddress, (int)cappedSize);
+        if (cache is not null && cache.TryGetValue(cacheKey, out var cached))
+        {
+            Interlocked.Increment(ref GlobalMemoryReadCacheHits);
+            data = cached;
+            return true;
+        }
+
+        byte[]? previous;
+        lock (_crossFrameReadGate)
+        {
+            _crossFrameReadCache.TryGetValue(cacheKey, out previous);
+        }
+
+        if (previous is not null && ctx.Memory.TryCompare(baseAddress, previous))
+        {
+            Interlocked.Increment(ref GlobalMemoryReadReuses);
+            if (cache is not null)
+            {
+                cache[cacheKey] = previous;
+            }
+
+            data = previous;
+            return true;
+        }
+
         var candidateSize = (int)cappedSize;
         while (candidateSize >= sizeof(uint))
         {
             data = GC.AllocateUninitializedArray<byte>(candidateSize);
-            if (ctx.Memory.TryRead(baseAddress, data) ||
+            var readFromPvm = ctx.Memory.TryRead(baseAddress, data);
+            if (readFromPvm ||
                 KernelMemoryCompatExports.TryReadTrackedLibcHeap(baseAddress, data))
             {
+                Interlocked.Increment(ref GlobalMemoryReadCount);
+                Interlocked.Add(ref GlobalMemoryReadBytes, data.Length);
+                if (readFromPvm)
+                {
+                    Interlocked.Add(ref GlobalMemoryReadPvmBytes, data.Length);
+                }
+                else
+                {
+                    Interlocked.Add(ref GlobalMemoryReadLibcBytes, data.Length);
+                }
+
+                if (cache is not null)
+                {
+                    cache[cacheKey] = data;
+                }
+
+                lock (_crossFrameReadGate)
+                {
+                    if (_crossFrameReadCache.TryGetValue(cacheKey, out var replaced))
+                    {
+                        _crossFrameReadCacheBytes -= replaced.Length;
+                    }
+
+                    if (_crossFrameReadCacheBytes + data.Length > CrossFrameReadCacheMaxBytes)
+                    {
+                        _crossFrameReadCache.Clear();
+                        _crossFrameReadCacheBytes = 0;
+                    }
+
+                    _crossFrameReadCache[cacheKey] = data;
+                    _crossFrameReadCacheBytes += data.Length;
+                }
+
                 return true;
             }
 

src/SharpEmu.Libs/Agc/Gen5SpirvTranslator.cs

@@ -18,19 +18,67 @@ internal static partial class Gen5SpirvTranslator
         out string error,
         int globalBufferBase = 0,
         int totalGlobalBufferCount = -1,
-        int imageBindingBase = 0)
+        int imageBindingBase = 0,
+        int scalarRegisterBufferIndex = -1) =>
+        TryCompilePixelShader(
+            state,
+            evaluation,
+            [new Gen5PixelOutputBinding(0, 0, outputKind)],
+            out shader,
+            out error,
+            globalBufferBase,
+            totalGlobalBufferCount,
+            imageBindingBase,
+            scalarRegisterBufferIndex);
+
+    public static bool TryCompilePixelShader(
+        Gen5ShaderState state,
+        Gen5ShaderEvaluation evaluation,
+        IReadOnlyList<Gen5PixelOutputBinding> outputs,
+        out Gen5SpirvShader shader,
+        out string error,
+        int globalBufferBase = 0,
+        int totalGlobalBufferCount = -1,
+        int imageBindingBase = 0,
+        int scalarRegisterBufferIndex = -1)
     {
+        if (outputs.Count > 8 || outputs.Any(output => output.GuestSlot > 7))
+        {
+            shader = default!;
+            error = "pixel outputs must contain at most eight guest slots in the 0..7 range";
+            return false;
+        }
+
+        if (outputs.Select(output => output.GuestSlot).Distinct().Count() != outputs.Count ||
+            outputs.Select(output => output.HostLocation).Distinct().Count() != outputs.Count)
+        {
+            shader = default!;
+            error = "pixel output guest slots and host locations must be unique";
+            return false;
+        }
+
+        if (!outputs
+                .OrderBy(output => output.HostLocation)
+                .Select((output, index) => output.HostLocation == (uint)index)
+                .All(isDense => isDense))
+        {
+            shader = default!;
+            error = "pixel output host locations must be dense in the 0..N-1 range";
+            return false;
+        }
+
         var context = new CompilationContext(
             Gen5SpirvStage.Pixel,
             state,
             evaluation,
-            outputKind,
+            outputs,
             1,
             1,
             1,
             globalBufferBase,
             totalGlobalBufferCount,
-            imageBindingBase);
+            imageBindingBase,
+            scalarRegisterBufferIndex);
         return context.TryCompile(out shader, out error);
     }
 
@@ -41,19 +89,21 @@ internal static partial class Gen5SpirvTranslator
         out string error,
         int globalBufferBase = 0,
         int totalGlobalBufferCount = -1,
-        int imageBindingBase = 0)
+        int imageBindingBase = 0,
+        int scalarRegisterBufferIndex = -1)
     {
         var context = new CompilationContext(
             Gen5SpirvStage.Vertex,
             state,
             evaluation,
-            Gen5PixelOutputKind.Float,
+            [],
             1,
             1,
             1,
             globalBufferBase,
             totalGlobalBufferCount,
-            imageBindingBase);
+            imageBindingBase,
+            scalarRegisterBufferIndex);
         return context.TryCompile(out shader, out error);
     }
 
@@ -70,13 +120,14 @@ internal static partial class Gen5SpirvTranslator
             Gen5SpirvStage.Compute,
             state,
             evaluation,
-            Gen5PixelOutputKind.Float,
+            [],
             Math.Max(localSizeX, 1),
             Math.Max(localSizeY, 1),
             Math.Max(localSizeZ, 1),
             0,
             -1,
-            0);
+            0,
+            -1);
         return context.TryCompile(out shader, out error);
     }
 
@@ -86,15 +137,17 @@ internal static partial class Gen5SpirvTranslator
         private readonly Gen5SpirvStage _stage;
         private readonly Gen5ShaderState _state;
         private readonly Gen5ShaderEvaluation _evaluation;
-        private readonly Gen5PixelOutputKind _outputKind;
+        private readonly IReadOnlyList<Gen5PixelOutputBinding> _pixelOutputBindings;
         private readonly uint _localSizeX;
         private readonly uint _localSizeY;
         private readonly uint _localSizeZ;
         private readonly int _globalBufferBase;
         private readonly int _totalGlobalBufferCount;
         private readonly int _imageBindingBase;
+        private readonly int _scalarRegisterBufferIndex;
         private readonly List<uint> _interfaces = [];
         private readonly Dictionary<uint, uint> _pixelInputs = [];
+        private readonly Dictionary<uint, SpirvPixelOutput> _pixelOutputs = [];
         private readonly Dictionary<uint, uint> _vertexOutputs = [];
         private readonly Dictionary<uint, SpirvVertexInput> _vertexInputsByPc = [];
         private readonly List<SpirvImageResource> _imageResources = [];
@@ -127,7 +180,6 @@ internal static partial class Gen5SpirvTranslator
         private uint _lds;
         private uint _workgroupUintPointer;
         private uint _positionOutput;
-        private uint _pixelOutput;
         private uint _vertexIndexInput;
         private uint _instanceIndexInput;
         private uint _fragCoordInput;
@@ -157,22 +209,28 @@ internal static partial class Gen5SpirvTranslator
             uint Type,
             uint ComponentCount);
 
+        private readonly record struct SpirvPixelOutput(
+            uint Variable,
+            uint Type,
+            Gen5PixelOutputKind Kind);
+
         public CompilationContext(
             Gen5SpirvStage stage,
             Gen5ShaderState state,
             Gen5ShaderEvaluation evaluation,
-            Gen5PixelOutputKind outputKind,
+            IReadOnlyList<Gen5PixelOutputBinding> pixelOutputBindings,
             uint localSizeX,
             uint localSizeY,
             uint localSizeZ,
             int globalBufferBase,
             int totalGlobalBufferCount,
-            int imageBindingBase)
+            int imageBindingBase,
+            int scalarRegisterBufferIndex)
         {
             _stage = stage;
             _state = state;
             _evaluation = evaluation;
-            _outputKind = outputKind;
+            _pixelOutputBindings = pixelOutputBindings;
             _localSizeX = localSizeX;
             _localSizeY = localSizeY;
             _localSizeZ = localSizeZ;
@@ -181,6 +239,7 @@ internal static partial class Gen5SpirvTranslator
                 ? evaluation.GlobalMemoryBindings.Count
                 : totalGlobalBufferCount;
             _imageBindingBase = imageBindingBase;
+            _scalarRegisterBufferIndex = scalarRegisterBufferIndex;
         }
 
         public bool TryCompile(out Gen5SpirvShader shader, out string error)
@@ -692,19 +751,24 @@ internal static partial class Gen5SpirvTranslator
                     (uint)SpirvBuiltIn.FragCoord);
                 _interfaces.Add(_fragCoordInput);
 
-                var outputType = _outputKind switch
+                foreach (var binding in _pixelOutputBindings)
                 {
-                    Gen5PixelOutputKind.Uint => _uvec4Type,
-                    Gen5PixelOutputKind.Sint => _module.TypeVector(_intType, 4),
-                    _ => _vec4Type,
-                };
-                var outputPointer =
-                    _module.TypePointer(SpirvStorageClass.Output, outputType);
-                _pixelOutput = _module.AddGlobalVariable(
-                    outputPointer,
-                    SpirvStorageClass.Output);
-                _module.AddDecoration(_pixelOutput, SpirvDecoration.Location, 0);
-                _interfaces.Add(_pixelOutput);
+                    var outputType = GetPixelOutputType(binding.Kind);
+                    var outputPointer =
+                        _module.TypePointer(SpirvStorageClass.Output, outputType);
+                    var variable = _module.AddGlobalVariable(
+                        outputPointer,
+                        SpirvStorageClass.Output);
+                    _module.AddName(variable, $"mrt{binding.GuestSlot}");
+                    _module.AddDecoration(
+                        variable,
+                        SpirvDecoration.Location,
+                        binding.HostLocation);
+                    _pixelOutputs.Add(
+                        binding.GuestSlot,
+                        new SpirvPixelOutput(variable, outputType, binding.Kind));
+                    _interfaces.Add(variable);
+                }
             }
             else
             {
@@ -767,15 +831,25 @@ internal static partial class Gen5SpirvTranslator
 
         private void EmitInitialState()
         {
-            for (uint index = 0;
-                 index < _evaluation.InitialScalarRegisters.Count &&
-                 index < ScalarRegisterCount;
-                 index++)
+            if (_scalarRegisterBufferIndex >= 0)
             {
-                var value = _evaluation.InitialScalarRegisters[(int)index];
-                if (value != 0)
+                for (uint index = 0; index < ScalarRegisterCount; index++)
                 {
-                    StoreS(index, UInt(value));
+                    StoreS(index, LoadBufferWord(_scalarRegisterBufferIndex, UInt(index)));
+                }
+            }
+            else
+            {
+                for (uint index = 0;
+                     index < _evaluation.InitialScalarRegisters.Count &&
+                     index < ScalarRegisterCount;
+                     index++)
+                {
+                    var value = _evaluation.InitialScalarRegisters[(int)index];
+                    if (value != 0)
+                    {
+                        StoreS(index, UInt(value));
+                    }
                 }
             }
 
@@ -813,7 +887,10 @@ internal static partial class Gen5SpirvTranslator
                     1);
                 StoreV(2, Bitcast(_uintType, x), guardWithExec: false);
                 StoreV(3, Bitcast(_uintType, y), guardWithExec: false);
-                Store(_pixelOutput, _module.ConstantNull(GetPixelOutputType()));
+                foreach (var output in _pixelOutputs.Values)
+                {
+                    Store(output.Variable, _module.ConstantNull(output.Type));
+                }
             }
             else
             {
@@ -2066,21 +2143,27 @@ internal static partial class Gen5SpirvTranslator
 
             if (_stage == Gen5SpirvStage.Pixel)
             {
-                if (export.Target != 0)
+                if (!_pixelOutputs.TryGetValue(export.Target, out var output))
                 {
                     return true;
                 }
 
-                var outputType = GetPixelOutputType();
                 var values = new uint[4];
                 for (var component = 0; component < 4; component++)
                 {
                     var enabled = (export.EnableMask & (1u << component)) != 0;
                     if (!enabled)
                     {
-                        values[component] = _outputKind == Gen5PixelOutputKind.Sint
-                            ? Bitcast(_intType, UInt(0))
-                            : UInt(0);
+                        values[component] = _module.AddInstruction(
+                            SpirvOp.CompositeExtract,
+                            output.Kind switch
+                            {
+                                Gen5PixelOutputKind.Uint => _uintType,
+                                Gen5PixelOutputKind.Sint => _intType,
+                                _ => _floatType,
+                            },
+                            Load(output.Type, output.Variable),
+                            (uint)component);
                         continue;
                     }
 
@@ -2089,7 +2172,7 @@ internal static partial class Gen5SpirvTranslator
                         var value = LoadCompressedExportComponent(
                             instruction,
                             component);
-                        values[component] = _outputKind switch
+                        values[component] = output.Kind switch
                         {
                             Gen5PixelOutputKind.Uint => _module.AddInstruction(
                                 SpirvOp.ConvertFToU,
@@ -2105,7 +2188,7 @@ internal static partial class Gen5SpirvTranslator
                     }
 
                     var raw = LoadV(instruction.Sources[component].Value);
-                    values[component] = _outputKind switch
+                    values[component] = output.Kind switch
                     {
                         Gen5PixelOutputKind.Uint => raw,
                         Gen5PixelOutputKind.Sint => Bitcast(_intType, raw),
@@ -2115,15 +2198,15 @@ internal static partial class Gen5SpirvTranslator
 
                 var vector = _module.AddInstruction(
                     SpirvOp.CompositeConstruct,
-                    outputType,
+                    output.Type,
                     values);
                 vector = _module.AddInstruction(
                     SpirvOp.Select,
-                    outputType,
+                    output.Type,
                     Load(_boolType, _exec),
                     vector,
-                    Load(outputType, _pixelOutput));
-                Store(_pixelOutput, vector);
+                    Load(output.Type, output.Variable));
+                Store(output.Variable, vector);
                 return true;
             }
 
@@ -2191,8 +2274,8 @@ internal static partial class Gen5SpirvTranslator
                 (uint)(component & 1));
         }
 
-        private uint GetPixelOutputType() =>
-            _outputKind switch
+        private uint GetPixelOutputType(Gen5PixelOutputKind kind) =>
+            kind switch
             {
                 Gen5PixelOutputKind.Uint => _uvec4Type,
                 Gen5PixelOutputKind.Sint => _module.TypeVector(_intType, 4),

src/SharpEmu.Libs/Ampr/AmprExports.cs

@@ -348,6 +348,18 @@ public static class AmprExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "Zi3dBUjgyXI",
+        ExportName = "sceAmprMeasureCommandSizeWriteKernelEventQueueOnCompletion",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAmpr")]
+    public static int MeasureCommandSizeWriteKernelEventQueueOnCompletion(CpuContext ctx)
+    {
+        TraceAmpr(ctx, "measure_write_equeue_complete", 0, KernelEventQueueRecordSize, 0);
+        ctx[CpuRegister.Rax] = KernelEventQueueRecordSize;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
     [SysAbiExport(
         Nid = "C+IEj+BsAFM",
         ExportName = "sceAmprMeasureCommandSizeWriteAddressOnCompletion",
@@ -440,6 +452,40 @@ public static class AmprExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "o67gODLFpls",
+        ExportName = "sceAmprCommandBufferWriteKernelEventQueueOnCompletion",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAmpr")]
+    public static int CommandBufferWriteKernelEventQueueOnCompletion(CpuContext ctx)
+    {
+        var commandBuffer = ctx[CpuRegister.Rdi];
+        var equeue = ctx[CpuRegister.Rsi];
+        var ident = ctx[CpuRegister.Rdx];
+        var completionToken = ctx[CpuRegister.Rcx];
+        var userData = ctx[CpuRegister.R8];
+
+        if (commandBuffer == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        if (!AppendKernelEventQueueRecord(
+                ctx,
+                commandBuffer,
+                equeue,
+                ident,
+                completionToken,
+                userData))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        TraceAmpr(ctx, "write_equeue_complete", commandBuffer, ident, completionToken);
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
     [SysAbiExport(
         Nid = "sJXyWHjP-F8",
         ExportName = "sceAmprCommandBufferWriteAddressOnCompletion",

src/SharpEmu.Libs/Ampr/PakDirectoryTracker.cs

@@ -54,20 +54,41 @@ internal static class PakDirectoryTracker
 
         if (state.Directory is { } entries)
         {
+            // Several unrelated archived files can share a byte count (e.g. a head model and a bot
+            // navigation file both 0x3A34 bytes). Directory order alone then picks whichever comes
+            // first, which is wrong when the game reads them out of order. id archives cluster
+            // related assets, and the guest streams them with locality, so disambiguate collisions
+            // by choosing the unconsumed match nearest the running read cursor.
+            DirectoryEntry? best = null;
+            var bestDistance = ulong.MaxValue;
             foreach (var entry in entries)
             {
-                if (!entry.Consumed && entry.FileLen == requestedSize)
+                if (entry.Consumed || entry.FileLen != requestedSize)
                 {
-                    entry.Consumed = true;
-                    if (_trace)
-                    {
-                        Console.Error.WriteLine(
-                            $"[LOADER][TRACE] pak.directory_match: id=0x{fileId:X8} name='{entry.Name}' " +
-                            $"filepos=0x{entry.FilePos:X8} filelen=0x{entry.FileLen:X8}");
-                    }
-
-                    return entry.FilePos;
+                    continue;
                 }
+
+                var distance = entry.FilePos >= state.NextOffset
+                    ? entry.FilePos - state.NextOffset
+                    : state.NextOffset - entry.FilePos;
+                if (distance < bestDistance)
+                {
+                    bestDistance = distance;
+                    best = entry;
+                }
+            }
+
+            if (best is not null)
+            {
+                best.Consumed = true;
+                if (_trace)
+                {
+                    Console.Error.WriteLine(
+                        $"[LOADER][TRACE] pak.directory_match: id=0x{fileId:X8} name='{best.Name}' " +
+                        $"filepos=0x{best.FilePos:X8} filelen=0x{best.FileLen:X8}");
+                }
+
+                return best.FilePos;
             }
         }
 

src/SharpEmu.Libs/Audio/AudioOutExports.cs

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 using SharpEmu.HLE;
+using SharpEmu.HLE.Host;
 using System.Buffers;
 using System.Collections.Concurrent;
 using System.Diagnostics;
@@ -27,7 +28,7 @@ public static class AudioOutExports
             int channels,
             int bytesPerSample,
             bool isFloat,
-            WinMmAudioPort? backend)
+            IHostAudioStream? backend)
         {
             UserId = userId;
             Type = type;
@@ -48,7 +49,7 @@ public static class AudioOutExports
         public int Channels { get; }
         public int BytesPerSample { get; }
         public bool IsFloat { get; }
-        public WinMmAudioPort? Backend { get; }
+        public IHostAudioStream? Backend { get; }
         public int BufferByteLength =>
             checked((int)BufferLength * Channels * BytesPerSample);
 
@@ -103,12 +104,13 @@ public static class AudioOutExports
             return ctx.SetReturn((int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
         }
 
-        WinMmAudioPort? backend = null;
+        IHostAudioStream? backend = null;
         string backendName;
         try
         {
-            backend = new WinMmAudioPort(frequency);
-            backendName = "winmm";
+            var audio = HostPlatform.Current.Audio;
+            backend = audio.OpenStereoPcm16Stream(frequency);
+            backendName = audio.BackendName;
         }
         catch (Exception exception)
         {
@@ -180,15 +182,31 @@ public static class AudioOutExports
                 return ctx.SetReturn((int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
             }
 
-            if (port.Backend is null ||
-                !port.Backend.Submit(
-                    source,
-                    port.BufferLength,
-                    port.Channels,
-                    port.BytesPerSample,
-                    port.IsFloat))
+            if (port.Backend is null)
             {
                 port.PaceSilence();
+                return ctx.SetReturn(0);
+            }
+
+            var outputLength = checked((int)port.BufferLength * AudioPcmConversion.OutputFrameSize);
+            var output = ArrayPool<byte>.Shared.Rent(outputLength);
+            try
+            {
+                AudioPcmConversion.ConvertToStereoPcm16(
+                    source,
+                    output.AsSpan(0, outputLength),
+                    checked((int)port.BufferLength),
+                    port.Channels,
+                    port.BytesPerSample,
+                    port.IsFloat);
+                if (!port.Backend.Submit(output.AsSpan(0, outputLength)))
+                {
+                    port.PaceSilence();
+                }
+            }
+            finally
+            {
+                ArrayPool<byte>.Shared.Return(output);
             }
 
             return ctx.SetReturn(0);
@@ -213,6 +231,17 @@ public static class AudioOutExports
                 : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
     }
 
+    public static void ShutdownAllPorts()
+    {
+        foreach (var handle in Ports.Keys)
+        {
+            if (Ports.TryRemove(handle, out var port))
+            {
+                port.Dispose();
+            }
+        }
+    }
+
     private static bool TryGetFormat(
         int rawFormat,
         out int channels,

src/SharpEmu.Libs/Audio/AudioPcmConversion.cs

@@ -0,0 +1,55 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Buffers.Binary;
+
+namespace SharpEmu.Libs.Audio;
+
+/// <summary>
+/// Converts guest AudioOut submissions (mono/stereo/7.1, s16 or float32) into the
+/// interleaved stereo 16-bit PCM that host audio streams accept. Platform-neutral —
+/// device specifics live behind IHostAudioStream.
+/// </summary>
+internal static class AudioPcmConversion
+{
+    /// <summary>Bytes per output frame: two 16-bit channels.</summary>
+    public const int OutputFrameSize = 4;
+
+    public static void ConvertToStereoPcm16(
+        ReadOnlySpan<byte> source,
+        Span<byte> destination,
+        int frames,
+        int channels,
+        int bytesPerSample,
+        bool isFloat)
+    {
+        var sourceFrameSize = checked(channels * bytesPerSample);
+        for (var frame = 0; frame < frames; frame++)
+        {
+            var sourceFrame = source.Slice(frame * sourceFrameSize, sourceFrameSize);
+            var left = ReadSample(sourceFrame, 0, bytesPerSample, isFloat);
+            var right = channels == 1
+                ? left
+                : ReadSample(sourceFrame, 1, bytesPerSample, isFloat);
+            BinaryPrimitives.WriteInt16LittleEndian(destination[(frame * OutputFrameSize)..], left);
+            BinaryPrimitives.WriteInt16LittleEndian(destination[((frame * OutputFrameSize) + 2)..], right);
+        }
+    }
+
+    private static short ReadSample(
+        ReadOnlySpan<byte> frame,
+        int channel,
+        int bytesPerSample,
+        bool isFloat)
+    {
+        var sample = frame.Slice(channel * bytesPerSample, bytesPerSample);
+        if (!isFloat)
+        {
+            return BinaryPrimitives.ReadInt16LittleEndian(sample);
+        }
+
+        var bits = BinaryPrimitives.ReadInt32LittleEndian(sample);
+        var value = Math.Clamp(BitConverter.Int32BitsToSingle(bits), -1.0f, 1.0f);
+        return checked((short)MathF.Round(value * short.MaxValue));
+    }
+}

src/SharpEmu.Libs/Audio/WinMmAudioPort.cs

@@ -1,302 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System.Buffers;
-using System.Buffers.Binary;
-using System.Runtime.InteropServices;
-
-namespace SharpEmu.Libs.Audio;
-
-internal sealed class WinMmAudioPort : IDisposable
-{
-    private const uint WaveMapper = uint.MaxValue;
-    private const uint CallbackEvent = 0x0005_0000;
-    private const ushort WaveFormatPcm = 1;
-    private const uint WaveHeaderDone = 0x0000_0001;
-    private const int MaximumQueuedPcmBytes = 32 * 1024;
-
-    private readonly object _gate = new();
-    private readonly AutoResetEvent _completion = new(false);
-    private readonly Queue<NativeBuffer> _buffers = new();
-    private IntPtr _device;
-    private int _queuedPcmBytes;
-    private bool _disposed;
-
-    public WinMmAudioPort(uint sampleRate)
-    {
-        if (!OperatingSystem.IsWindows())
-        {
-            throw new PlatformNotSupportedException("WinMM audio is only available on Windows.");
-        }
-
-        var format = new WaveFormat
-        {
-            FormatTag = WaveFormatPcm,
-            Channels = 2,
-            SamplesPerSecond = sampleRate,
-            AverageBytesPerSecond = checked(sampleRate * 4),
-            BlockAlign = 4,
-            BitsPerSample = 16,
-            ExtraSize = 0,
-        };
-        var result = WaveOutOpen(
-            out _device,
-            WaveMapper,
-            ref format,
-            _completion.SafeWaitHandle.DangerousGetHandle(),
-            IntPtr.Zero,
-            CallbackEvent);
-        if (result != 0)
-        {
-            throw new InvalidOperationException($"waveOutOpen failed with MMRESULT {result}.");
-        }
-    }
-
-    public bool Submit(
-        ReadOnlySpan<byte> source,
-        uint frames,
-        int channels,
-        int bytesPerSample,
-        bool isFloat)
-    {
-        lock (_gate)
-        {
-            if (_disposed)
-            {
-                return false;
-            }
-
-            var outputLength = checked((int)frames * 4);
-            ReapCompletedBuffers();
-            while (_queuedPcmBytes != 0 &&
-                   _queuedPcmBytes + outputLength > MaximumQueuedPcmBytes)
-            {
-                if (!_completion.WaitOne(TimeSpan.FromSeconds(1)))
-                {
-                    return false;
-                }
-
-                ReapCompletedBuffers();
-            }
-
-            var output = ArrayPool<byte>.Shared.Rent(outputLength);
-            try
-            {
-                ConvertToStereoPcm16(
-                    source,
-                    output.AsSpan(0, outputLength),
-                    checked((int)frames),
-                    channels,
-                    bytesPerSample,
-                    isFloat);
-                return QueueBuffer(output.AsSpan(0, outputLength));
-            }
-            finally
-            {
-                ArrayPool<byte>.Shared.Return(output);
-            }
-        }
-    }
-
-    public void Dispose()
-    {
-        lock (_gate)
-        {
-            if (_disposed)
-            {
-                return;
-            }
-
-            _disposed = true;
-            if (_device != IntPtr.Zero)
-            {
-                WaveOutReset(_device);
-                while (_buffers.TryDequeue(out var buffer))
-                {
-                    ReleaseBuffer(buffer);
-                }
-
-                WaveOutClose(_device);
-                _device = IntPtr.Zero;
-            }
-
-            _completion.Dispose();
-        }
-    }
-
-    private bool QueueBuffer(ReadOnlySpan<byte> data)
-    {
-        var dataAddress = Marshal.AllocHGlobal(data.Length);
-        var headerAddress = IntPtr.Zero;
-        try
-        {
-            unsafe
-            {
-                data.CopyTo(new Span<byte>((void*)dataAddress, data.Length));
-            }
-
-            var header = new WaveHeader
-            {
-                Data = dataAddress,
-                BufferLength = checked((uint)data.Length),
-            };
-            headerAddress = Marshal.AllocHGlobal(Marshal.SizeOf<WaveHeader>());
-            Marshal.StructureToPtr(header, headerAddress, false);
-
-            var result = WaveOutPrepareHeader(
-                _device,
-                headerAddress,
-                checked((uint)Marshal.SizeOf<WaveHeader>()));
-            if (result != 0)
-            {
-                return false;
-            }
-
-            result = WaveOutWrite(
-                _device,
-                headerAddress,
-                checked((uint)Marshal.SizeOf<WaveHeader>()));
-            if (result != 0)
-            {
-                WaveOutUnprepareHeader(
-                    _device,
-                    headerAddress,
-                    checked((uint)Marshal.SizeOf<WaveHeader>()));
-                return false;
-            }
-
-            _buffers.Enqueue(new NativeBuffer(dataAddress, headerAddress, data.Length));
-            _queuedPcmBytes += data.Length;
-            dataAddress = IntPtr.Zero;
-            headerAddress = IntPtr.Zero;
-            return true;
-        }
-        finally
-        {
-            if (headerAddress != IntPtr.Zero)
-            {
-                Marshal.FreeHGlobal(headerAddress);
-            }
-
-            if (dataAddress != IntPtr.Zero)
-            {
-                Marshal.FreeHGlobal(dataAddress);
-            }
-        }
-    }
-
-    private void ReapCompletedBuffers()
-    {
-        while (_buffers.TryPeek(out var buffer))
-        {
-            var header = Marshal.PtrToStructure<WaveHeader>(buffer.Header);
-            if ((header.Flags & WaveHeaderDone) == 0)
-            {
-                return;
-            }
-
-            _buffers.Dequeue();
-            ReleaseBuffer(buffer);
-        }
-    }
-
-    private void ReleaseBuffer(NativeBuffer buffer)
-    {
-        WaveOutUnprepareHeader(
-            _device,
-            buffer.Header,
-            checked((uint)Marshal.SizeOf<WaveHeader>()));
-        _queuedPcmBytes -= buffer.Length;
-        Marshal.FreeHGlobal(buffer.Header);
-        Marshal.FreeHGlobal(buffer.Data);
-    }
-
-    private static void ConvertToStereoPcm16(
-        ReadOnlySpan<byte> source,
-        Span<byte> destination,
-        int frames,
-        int channels,
-        int bytesPerSample,
-        bool isFloat)
-    {
-        var sourceFrameSize = checked(channels * bytesPerSample);
-        for (var frame = 0; frame < frames; frame++)
-        {
-            var sourceFrame = source.Slice(frame * sourceFrameSize, sourceFrameSize);
-            var left = ReadSample(sourceFrame, 0, bytesPerSample, isFloat);
-            var right = channels == 1
-                ? left
-                : ReadSample(sourceFrame, 1, bytesPerSample, isFloat);
-            BinaryPrimitives.WriteInt16LittleEndian(destination[(frame * 4)..], left);
-            BinaryPrimitives.WriteInt16LittleEndian(destination[((frame * 4) + 2)..], right);
-        }
-    }
-
-    private static short ReadSample(
-        ReadOnlySpan<byte> frame,
-        int channel,
-        int bytesPerSample,
-        bool isFloat)
-    {
-        var sample = frame.Slice(channel * bytesPerSample, bytesPerSample);
-        if (!isFloat)
-        {
-            return BinaryPrimitives.ReadInt16LittleEndian(sample);
-        }
-
-        var bits = BinaryPrimitives.ReadInt32LittleEndian(sample);
-        var value = Math.Clamp(BitConverter.Int32BitsToSingle(bits), -1.0f, 1.0f);
-        return checked((short)MathF.Round(value * short.MaxValue));
-    }
-
-    private readonly record struct NativeBuffer(IntPtr Data, IntPtr Header, int Length);
-
-    [StructLayout(LayoutKind.Sequential, Pack = 2)]
-    private struct WaveFormat
-    {
-        public ushort FormatTag;
-        public ushort Channels;
-        public uint SamplesPerSecond;
-        public uint AverageBytesPerSecond;
-        public ushort BlockAlign;
-        public ushort BitsPerSample;
-        public ushort ExtraSize;
-    }
-
-    [StructLayout(LayoutKind.Sequential)]
-    private struct WaveHeader
-    {
-        public IntPtr Data;
-        public uint BufferLength;
-        public uint BytesRecorded;
-        public nuint User;
-        public uint Flags;
-        public uint Loops;
-        public IntPtr Next;
-        public nuint Reserved;
-    }
-
-    [DllImport("winmm.dll", EntryPoint = "waveOutOpen")]
-    private static extern uint WaveOutOpen(
-        out IntPtr device,
-        uint deviceId,
-        ref WaveFormat format,
-        IntPtr callback,
-        IntPtr instance,
-        uint flags);
-
-    [DllImport("winmm.dll", EntryPoint = "waveOutPrepareHeader")]
-    private static extern uint WaveOutPrepareHeader(IntPtr device, IntPtr header, uint headerSize);
-
-    [DllImport("winmm.dll", EntryPoint = "waveOutWrite")]
-    private static extern uint WaveOutWrite(IntPtr device, IntPtr header, uint headerSize);
-
-    [DllImport("winmm.dll", EntryPoint = "waveOutUnprepareHeader")]
-    private static extern uint WaveOutUnprepareHeader(IntPtr device, IntPtr header, uint headerSize);
-
-    [DllImport("winmm.dll", EntryPoint = "waveOutReset")]
-    private static extern uint WaveOutReset(IntPtr device);
-
-    [DllImport("winmm.dll", EntryPoint = "waveOutClose")]
-    private static extern uint WaveOutClose(IntPtr device);
-}

src/SharpEmu.Libs/AvPlayer/AvPlayerExports.cs

@@ -35,6 +35,17 @@ public static class AvPlayerExports
         return unchecked((int)handle);
     }
 
+    [SysAbiExport(
+        Nid = "KMcEa+rHsIo",
+        ExportName = "sceAvPlayerAddSource",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAvPlayer")]
+    public static int AvPlayerAddSource(CpuContext ctx)
+    {
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
     [SysAbiExport(
         Nid = "JdksQu8pNdQ",
         ExportName = "sceAvPlayerGetVideoDataEx",

src/SharpEmu.Libs/CommonDialog/MsgDialogExports.cs

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 using SharpEmu.HLE;
+using System.Buffers.Binary;
 using System.Threading;
 
 namespace SharpEmu.Libs.CommonDialog;
@@ -10,10 +11,21 @@ public static class MsgDialogExports
 {
     private const int StatusNone = 0;
     private const int StatusInitialized = 1;
+    private const int StatusRunning = 2;
     private const int StatusFinished = 3;
-    private const int ResultSize = 0x20;
 
-    private static int _initialized;
+    private const int ErrorOk = 0;
+    private const int ErrorNotInitialized = unchecked((int)0x80B80003);
+    private const int ErrorNotFinished = unchecked((int)0x80B80005);
+    private const int ErrorBusy = unchecked((int)0x80B80007);
+    private const int ErrorNotRunning = unchecked((int)0x80B8000B);
+    private const int ErrorArgNull = unchecked((int)0x80B8000D);
+
+    // Result buffer layout follows the common dialog convention: mode at +0x00,
+    // result at +0x04, buttonId at +0x08. The affirmative button (OK/YES) is 1.
+    private const int ResultSize = 0x20;
+    private const int ButtonIdAffirmative = 1;
+
     private static int _status;
 
     [SysAbiExport(
@@ -24,11 +36,10 @@ public static class MsgDialogExports
     public static int MsgDialogInitialize(CpuContext ctx)
     {
         // Treat repeated initialization as success. The dialog service is process-global in
-        // this HLE implementation and has no per-call resources to recreate.
-        Interlocked.Exchange(ref _initialized, 1);
-        Interlocked.Exchange(ref _status, StatusInitialized);
-        ctx[CpuRegister.Rax] = 0;
-        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+        // this HLE implementation and has no per-call resources to recreate. Only promote
+        // from NONE so re-initializing mid-flow cannot clobber a running/finished dialog.
+        Interlocked.CompareExchange(ref _status, StatusInitialized, StatusNone);
+        return ctx.SetReturn(ErrorOk);
     }
 
     [SysAbiExport(
@@ -38,9 +49,12 @@ public static class MsgDialogExports
         LibraryName = "libSceMsgDialog")]
     public static int MsgDialogTerminate(CpuContext ctx)
     {
-        Interlocked.Exchange(ref _initialized, 0);
-        Interlocked.Exchange(ref _status, StatusNone);
-        return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_OK);
+        if (Interlocked.Exchange(ref _status, StatusNone) == StatusNone)
+        {
+            return ctx.SetReturn(ErrorNotInitialized);
+        }
+
+        return ctx.SetReturn(ErrorOk);
     }
 
     [SysAbiExport(
@@ -50,13 +64,29 @@ public static class MsgDialogExports
         LibraryName = "libSceMsgDialog")]
     public static int MsgDialogOpen(CpuContext ctx)
     {
-        LogDialogMessage(ctx, ctx[CpuRegister.Rdi]);
+        var paramAddress = ctx[CpuRegister.Rdi];
+        if (paramAddress == 0)
+        {
+            return ctx.SetReturn(ErrorArgNull);
+        }
 
-        // There is no host popup to actually show. Complete immediately with "finished" so a
-        // guest polling loop (GetStatus/UpdateStatus -> GetResult -> Close) sees a dismissed
-        // dialog on its very first poll instead of spinning forever waiting for user input.
-        Interlocked.Exchange(ref _status, StatusFinished);
-        return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_OK);
+        var status = Volatile.Read(ref _status);
+        if (status == StatusNone)
+        {
+            return ctx.SetReturn(ErrorNotInitialized);
+        }
+
+        if (status == StatusRunning)
+        {
+            return ctx.SetReturn(ErrorBusy);
+        }
+
+        LogDialogMessage(ctx, paramAddress);
+
+        // There is no host popup to actually show. Enter RUNNING so close/cancel paths see
+        // a live dialog; the guest's next status poll auto-dismisses it (see PollStatus).
+        Interlocked.Exchange(ref _status, StatusRunning);
+        return ctx.SetReturn(ErrorOk);
     }
 
     // Best-effort extraction of the dialog text so fatal-error popups are visible in the
@@ -65,12 +95,6 @@ public static class MsgDialogExports
     // level deep, then a second level for nested sub-param structs.
     private static void LogDialogMessage(CpuContext ctx, ulong paramAddress)
     {
-        if (paramAddress == 0)
-        {
-            Console.Error.WriteLine("[LOADER][INFO] sceMsgDialogOpen: param=NULL");
-            return;
-        }
-
         Console.Error.WriteLine($"[LOADER][INFO] sceMsgDialogOpen: param=0x{paramAddress:X12}");
 
         Span<byte> head = stackalloc byte[0xA0];
@@ -134,14 +158,24 @@ public static class MsgDialogExports
         ExportName = "sceMsgDialogGetStatus",
         Target = Generation.Gen4 | Generation.Gen5,
         LibraryName = "libSceMsgDialog")]
-    public static int MsgDialogGetStatus(CpuContext ctx) => SetReturn(ctx, Volatile.Read(ref _status));
+    public static int MsgDialogGetStatus(CpuContext ctx) => ctx.SetReturn(PollStatus());
 
     [SysAbiExport(
         Nid = "6fIC3XKt2k0",
         ExportName = "sceMsgDialogUpdateStatus",
         Target = Generation.Gen4 | Generation.Gen5,
         LibraryName = "libSceMsgDialog")]
-    public static int MsgDialogUpdateStatus(CpuContext ctx) => SetReturn(ctx, Volatile.Read(ref _status));
+    public static int MsgDialogUpdateStatus(CpuContext ctx) => ctx.SetReturn(PollStatus());
+
+    // With no host UI the dialog cannot wait for user input: the first status poll after
+    // Open observes the dialog as already dismissed. Advancing on both UpdateStatus and
+    // GetStatus keeps every guest polling pattern free of infinite RUNNING loops, while
+    // an Open -> Close sequence with no poll in between still exercises the close path.
+    private static int PollStatus()
+    {
+        Interlocked.CompareExchange(ref _status, StatusFinished, StatusRunning);
+        return Volatile.Read(ref _status);
+    }
 
     [SysAbiExport(
         Nid = "Lr8ovHH9l6A",
@@ -153,17 +187,27 @@ public static class MsgDialogExports
         var resultAddress = ctx[CpuRegister.Rdi];
         if (resultAddress == 0)
         {
-            return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+            return ctx.SetReturn(ErrorArgNull);
         }
 
+        if (Volatile.Read(ref _status) != StatusFinished)
+        {
+            return ctx.SetReturn(ErrorNotFinished);
+        }
+
+        // Report the affirmative button so yes/no prompts take the confirming branch;
+        // buttonId 0 is the "invalid" sentinel and games may treat it as an error.
         Span<byte> result = stackalloc byte[ResultSize];
         result.Clear();
+        BinaryPrimitives.WriteInt32LittleEndian(result[0x04..], 0);
+        BinaryPrimitives.WriteInt32LittleEndian(result[0x08..], ButtonIdAffirmative);
+
         if (!ctx.Memory.TryWrite(resultAddress, result))
         {
-            return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+            return ctx.SetReturn((int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
         }
 
-        return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_OK);
+        return ctx.SetReturn(ErrorOk);
     }
 
     [SysAbiExport(
@@ -173,13 +217,44 @@ public static class MsgDialogExports
         LibraryName = "libSceMsgDialog")]
     public static int MsgDialogClose(CpuContext ctx)
     {
-        Interlocked.Exchange(ref _status, StatusFinished);
-        return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_OK);
+        if (Interlocked.CompareExchange(ref _status, StatusFinished, StatusRunning) != StatusRunning)
+        {
+            return ctx.SetReturn(ErrorNotRunning);
+        }
+
+        return ctx.SetReturn(ErrorOk);
     }
 
-    private static int SetReturn(CpuContext ctx, int result)
+    [SysAbiExport(
+        Nid = "wTpfglkmv34",
+        ExportName = "sceMsgDialogProgressBarSetValue",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceMsgDialog")]
+    public static int MsgDialogProgressBarSetValue(CpuContext ctx) => ProgressBarNoOp(ctx);
+
+    [SysAbiExport(
+        Nid = "Gc5k1qcK4fs",
+        ExportName = "sceMsgDialogProgressBarInc",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceMsgDialog")]
+    public static int MsgDialogProgressBarInc(CpuContext ctx) => ProgressBarNoOp(ctx);
+
+    [SysAbiExport(
+        Nid = "6H-71OdrpXM",
+        ExportName = "sceMsgDialogProgressBarSetMsg",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceMsgDialog")]
+    public static int MsgDialogProgressBarSetMsg(CpuContext ctx) => ProgressBarNoOp(ctx);
+
+    // There is no visible bar to update. Accept the call whenever the service is alive so
+    // save/install loops that report progress do not abort on an unexpected error.
+    private static int ProgressBarNoOp(CpuContext ctx)
     {
-        ctx[CpuRegister.Rax] = unchecked((ulong)result);
-        return result;
+        if (Volatile.Read(ref _status) == StatusNone)
+        {
+            return ctx.SetReturn(ErrorNotInitialized);
+        }
+
+        return ctx.SetReturn(ErrorOk);
     }
 }

src/SharpEmu.Libs/HostTimerResolution.cs

@@ -1,46 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System.Runtime.InteropServices;
-using System.Runtime.Versioning;
-
-namespace SharpEmu.Libs;
-
-public static class HostTimerResolution
-{
-    private const uint TargetPeriodMilliseconds = 1;
-
-    private static int _requested;
-
-    public static void Request()
-    {
-        if (Interlocked.Exchange(ref _requested, 1) != 0)
-        {
-            return;
-        }
-
-        if (!OperatingSystem.IsWindows())
-        {
-            return;
-        }
-
-        try
-        {
-            if (TimeBeginPeriod(TargetPeriodMilliseconds) != 0)
-            {
-                Console.Error.WriteLine(
-                    "[LOADER][WARN] Host timer resolution request rejected; " +
-                    "timed waits keep the default ~15.6 ms granularity.");
-            }
-        }
-        catch (DllNotFoundException exception)
-        {
-            Console.Error.WriteLine(
-                $"[LOADER][WARN] Host timer resolution unavailable: {exception.Message}");
-        }
-    }
-
-    [SupportedOSPlatform("windows")]
-    [DllImport("winmm.dll", EntryPoint = "timeBeginPeriod", ExactSpelling = true)]
-    private static extern uint TimeBeginPeriod(uint uPeriod);
-}

src/SharpEmu.Libs/Json/JsonExports.cs

@@ -78,6 +78,30 @@ public static class JsonExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    // sce::Json::Initializer::setGlobalNullAccessCallback(const Value& (*)(ValueType, const Value*, void*), void*)
+    // Registers the guest hook invoked when a Value is accessed as the wrong type. Quake calls it
+    // during kexPSNWebAPI::Initialize and treats a non-zero return as a fatal init failure.
+    [SysAbiExport(
+        Nid = "+drDFyAS6u4",
+        ExportName = "_ZN3sce4Json11Initializer27setGlobalNullAccessCallbackEPFRKNS0_5ValueENS0_9ValueTypeEPS3_PvES7_",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceJson")]
+    public static int InitializerSetGlobalNullAccessCallback(CpuContext ctx)
+    {
+        var thisAddress = ctx[CpuRegister.Rdi];
+        if (thisAddress == 0)
+        {
+            ctx[CpuRegister.Rax] = unchecked((ulong)(int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        JsonObjectHeap.GlobalNullAccessCallback = ctx[CpuRegister.Rsi];
+        JsonObjectHeap.GlobalNullAccessCallbackContext = ctx[CpuRegister.Rdx];
+        TraceJson("Initializer.setGlobalNullAccessCallback", thisAddress, ctx[CpuRegister.Rsi]);
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
     [SysAbiExport(
         Nid = "WSOuge5IsCg",
         ExportName = "_ZN3sce4Json14InitParameter2C1Ev",

src/SharpEmu.Libs/Json/JsonValueExports.cs

@@ -0,0 +1,234 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.Json;
+
+// sce::Json::Value and sce::Json::String constructors, setters and destructors. Prospero titles
+// (Quake among them) build a Value tree and populate it through these before serializing it for a
+// web request; without them the imports resolve to nothing and the guest faults on the call. The
+// payload is modelled in JsonObjectHeap; here we only translate the C++ ABI (registers in, `this`
+// back out) and never write the guest object, so a stack-allocated Value/String is left intact.
+//
+// Only the complete-object variants (C1/D1) are bound — those are what standalone locals emit and
+// what the observed Prospero imports use. The base-object variants (C2/D2) are left for a title
+// that actually imports them.
+public static class JsonValueExports
+{
+    private const int MaxStringLength = 0x10000;
+
+    private static int ReturnThis(CpuContext ctx, ulong thisAddress)
+    {
+        ctx[CpuRegister.Rax] = thisAddress;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    private static int ReturnVoid(CpuContext ctx)
+    {
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    private static double ReadDoubleArg(CpuContext ctx)
+    {
+        ctx.GetXmmRegister(0, out var low, out _);
+        return BitConverter.Int64BitsToDouble(unchecked((long)low));
+    }
+
+    private static string ReadCString(CpuContext ctx, ulong address) =>
+        ctx.TryReadNullTerminatedUtf8(address, MaxStringLength, out var text) ? text : string.Empty;
+
+    // ---- sce::Json::Value constructors ----
+
+    [SysAbiExport(Nid = "qBMjqyBn3OM", ExportName = "_ZN3sce4Json5ValueC1Ev",
+        Target = Generation.Gen4 | Generation.Gen5, LibraryName = "libSceJson")]
+    public static int ValueDefaultConstructor(CpuContext ctx)
+    {
+        var thisAddress = ctx[CpuRegister.Rdi];
+        JsonObjectHeap.SetValue(thisAddress, JsonValueState.Null);
+        return ReturnThis(ctx, thisAddress);
+    }
+
+    [SysAbiExport(Nid = "UeuWT+yNdCQ", ExportName = "_ZN3sce4Json5ValueC1Eb",
+        Target = Generation.Gen4 | Generation.Gen5, LibraryName = "libSceJson")]
+    public static int ValueBooleanConstructor(CpuContext ctx)
+    {
+        var thisAddress = ctx[CpuRegister.Rdi];
+        JsonObjectHeap.SetValue(thisAddress, JsonValueState.FromBoolean((ctx[CpuRegister.Rsi] & 0xFF) != 0));
+        return ReturnThis(ctx, thisAddress);
+    }
+
+    [SysAbiExport(Nid = "0lLK8+kDqmE", ExportName = "_ZN3sce4Json5ValueC1El",
+        Target = Generation.Gen4 | Generation.Gen5, LibraryName = "libSceJson")]
+    public static int ValueIntegerConstructor(CpuContext ctx)
+    {
+        var thisAddress = ctx[CpuRegister.Rdi];
+        JsonObjectHeap.SetValue(thisAddress, JsonValueState.FromInteger(unchecked((long)ctx[CpuRegister.Rsi])));
+        return ReturnThis(ctx, thisAddress);
+    }
+
+    [SysAbiExport(Nid = "x4AUdbhpRB0", ExportName = "_ZN3sce4Json5ValueC1Em",
+        Target = Generation.Gen4 | Generation.Gen5, LibraryName = "libSceJson")]
+    public static int ValueUnsignedConstructor(CpuContext ctx)
+    {
+        var thisAddress = ctx[CpuRegister.Rdi];
+        JsonObjectHeap.SetValue(thisAddress, JsonValueState.FromUnsignedInteger(ctx[CpuRegister.Rsi]));
+        return ReturnThis(ctx, thisAddress);
+    }
+
+    [SysAbiExport(Nid = "sOmU4vnx3s0", ExportName = "_ZN3sce4Json5ValueC1Ed",
+        Target = Generation.Gen4 | Generation.Gen5, LibraryName = "libSceJson")]
+    public static int ValueRealConstructor(CpuContext ctx)
+    {
+        var thisAddress = ctx[CpuRegister.Rdi];
+        JsonObjectHeap.SetValue(thisAddress, JsonValueState.FromReal(ReadDoubleArg(ctx)));
+        return ReturnThis(ctx, thisAddress);
+    }
+
+    [SysAbiExport(Nid = "b9V6fmppLXY", ExportName = "_ZN3sce4Json5ValueC1EPKc",
+        Target = Generation.Gen4 | Generation.Gen5, LibraryName = "libSceJson")]
+    public static int ValueCStringConstructor(CpuContext ctx)
+    {
+        var thisAddress = ctx[CpuRegister.Rdi];
+        JsonObjectHeap.SetValue(thisAddress, JsonValueState.FromString(ReadCString(ctx, ctx[CpuRegister.Rsi])));
+        return ReturnThis(ctx, thisAddress);
+    }
+
+    [SysAbiExport(Nid = "CbrT3dwDILo", ExportName = "_ZN3sce4Json5ValueC1ENS0_9ValueTypeE",
+        Target = Generation.Gen4 | Generation.Gen5, LibraryName = "libSceJson")]
+    public static int ValueTypeConstructor(CpuContext ctx)
+    {
+        var thisAddress = ctx[CpuRegister.Rdi];
+        JsonObjectHeap.SetValue(thisAddress, JsonValueState.FromExplicitType(unchecked((uint)ctx[CpuRegister.Rsi])));
+        return ReturnThis(ctx, thisAddress);
+    }
+
+    [SysAbiExport(Nid = "sZIoMRGO+jk", ExportName = "_ZN3sce4Json5ValueC1ERKNS0_6StringE",
+        Target = Generation.Gen4 | Generation.Gen5, LibraryName = "libSceJson")]
+    public static int ValueStringConstructor(CpuContext ctx)
+    {
+        var thisAddress = ctx[CpuRegister.Rdi];
+        JsonObjectHeap.SetValue(thisAddress, JsonValueState.FromString(JsonObjectHeap.GetStringOrEmpty(ctx[CpuRegister.Rsi])));
+        return ReturnThis(ctx, thisAddress);
+    }
+
+    [SysAbiExport(Nid = "WTtYf+cNnXI", ExportName = "_ZN3sce4Json5ValueD1Ev",
+        Target = Generation.Gen4 | Generation.Gen5, LibraryName = "libSceJson")]
+    public static int ValueDestructor(CpuContext ctx)
+    {
+        JsonObjectHeap.RemoveValue(ctx[CpuRegister.Rdi]);
+        return ReturnVoid(ctx);
+    }
+
+    // ---- sce::Json::Value setters (return Value&, i.e. `this`) ----
+
+    [SysAbiExport(Nid = "5yHuiWXo2gg", ExportName = "_ZN3sce4Json5Value3setEb",
+        Target = Generation.Gen4 | Generation.Gen5, LibraryName = "libSceJson")]
+    public static int ValueSetBoolean(CpuContext ctx)
+    {
+        var thisAddress = ctx[CpuRegister.Rdi];
+        JsonObjectHeap.SetValue(thisAddress, JsonValueState.FromBoolean((ctx[CpuRegister.Rsi] & 0xFF) != 0));
+        return ReturnThis(ctx, thisAddress);
+    }
+
+    [SysAbiExport(Nid = "QxVVYhP-mvg", ExportName = "_ZN3sce4Json5Value3setEl",
+        Target = Generation.Gen4 | Generation.Gen5, LibraryName = "libSceJson")]
+    public static int ValueSetInteger(CpuContext ctx)
+    {
+        var thisAddress = ctx[CpuRegister.Rdi];
+        JsonObjectHeap.SetValue(thisAddress, JsonValueState.FromInteger(unchecked((long)ctx[CpuRegister.Rsi])));
+        return ReturnThis(ctx, thisAddress);
+    }
+
+    [SysAbiExport(Nid = "SIe1ZmW7e7s", ExportName = "_ZN3sce4Json5Value3setEm",
+        Target = Generation.Gen4 | Generation.Gen5, LibraryName = "libSceJson")]
+    public static int ValueSetUnsigned(CpuContext ctx)
+    {
+        var thisAddress = ctx[CpuRegister.Rdi];
+        JsonObjectHeap.SetValue(thisAddress, JsonValueState.FromUnsignedInteger(ctx[CpuRegister.Rsi]));
+        return ReturnThis(ctx, thisAddress);
+    }
+
+    [SysAbiExport(Nid = "BSmWDIkV4w4", ExportName = "_ZN3sce4Json5Value3setEd",
+        Target = Generation.Gen4 | Generation.Gen5, LibraryName = "libSceJson")]
+    public static int ValueSetReal(CpuContext ctx)
+    {
+        var thisAddress = ctx[CpuRegister.Rdi];
+        JsonObjectHeap.SetValue(thisAddress, JsonValueState.FromReal(ReadDoubleArg(ctx)));
+        return ReturnThis(ctx, thisAddress);
+    }
+
+    [SysAbiExport(Nid = "IKQimvG9Wqs", ExportName = "_ZN3sce4Json5Value3setENS0_9ValueTypeE",
+        Target = Generation.Gen4 | Generation.Gen5, LibraryName = "libSceJson")]
+    public static int ValueSetType(CpuContext ctx)
+    {
+        var thisAddress = ctx[CpuRegister.Rdi];
+        JsonObjectHeap.SetValue(thisAddress, JsonValueState.FromExplicitType(unchecked((uint)ctx[CpuRegister.Rsi])));
+        return ReturnThis(ctx, thisAddress);
+    }
+
+    [SysAbiExport(Nid = "n6FC+l9DU70", ExportName = "_ZN3sce4Json5Value3setEPKc",
+        Target = Generation.Gen4 | Generation.Gen5, LibraryName = "libSceJson")]
+    public static int ValueSetCString(CpuContext ctx)
+    {
+        var thisAddress = ctx[CpuRegister.Rdi];
+        JsonObjectHeap.SetValue(thisAddress, JsonValueState.FromString(ReadCString(ctx, ctx[CpuRegister.Rsi])));
+        return ReturnThis(ctx, thisAddress);
+    }
+
+    [SysAbiExport(Nid = "6l3Bv2gysNc", ExportName = "_ZN3sce4Json5Value3setERKNS0_6StringE",
+        Target = Generation.Gen4 | Generation.Gen5, LibraryName = "libSceJson")]
+    public static int ValueSetString(CpuContext ctx)
+    {
+        var thisAddress = ctx[CpuRegister.Rdi];
+        JsonObjectHeap.SetValue(thisAddress, JsonValueState.FromString(JsonObjectHeap.GetStringOrEmpty(ctx[CpuRegister.Rsi])));
+        return ReturnThis(ctx, thisAddress);
+    }
+
+    [SysAbiExport(Nid = "FIjXN2TkuTs", ExportName = "_ZN3sce4Json5Value5clearEv",
+        Target = Generation.Gen4 | Generation.Gen5, LibraryName = "libSceJson")]
+    public static int ValueClear(CpuContext ctx)
+    {
+        var thisAddress = ctx[CpuRegister.Rdi];
+        JsonObjectHeap.SetValue(thisAddress, JsonValueState.Null);
+        return ReturnThis(ctx, thisAddress);
+    }
+
+    // ---- sce::Json::String ----
+
+    [SysAbiExport(Nid = "9KUZFjI1IxA", ExportName = "_ZN3sce4Json6StringC1EPKc",
+        Target = Generation.Gen4 | Generation.Gen5, LibraryName = "libSceJson")]
+    public static int StringCStringConstructor(CpuContext ctx)
+    {
+        var thisAddress = ctx[CpuRegister.Rdi];
+        JsonObjectHeap.SetString(thisAddress, ReadCString(ctx, ctx[CpuRegister.Rsi]));
+        return ReturnThis(ctx, thisAddress);
+    }
+
+    [SysAbiExport(Nid = "qSmqLXXCPas", ExportName = "_ZN3sce4Json6StringC1Ev",
+        Target = Generation.Gen4 | Generation.Gen5, LibraryName = "libSceJson")]
+    public static int StringDefaultConstructor(CpuContext ctx)
+    {
+        var thisAddress = ctx[CpuRegister.Rdi];
+        JsonObjectHeap.SetString(thisAddress, string.Empty);
+        return ReturnThis(ctx, thisAddress);
+    }
+
+    [SysAbiExport(Nid = "0CAesfH963Q", ExportName = "_ZN3sce4Json6StringC1ERKS1_",
+        Target = Generation.Gen4 | Generation.Gen5, LibraryName = "libSceJson")]
+    public static int StringCopyConstructor(CpuContext ctx)
+    {
+        var thisAddress = ctx[CpuRegister.Rdi];
+        JsonObjectHeap.SetString(thisAddress, JsonObjectHeap.GetStringOrEmpty(ctx[CpuRegister.Rsi]));
+        return ReturnThis(ctx, thisAddress);
+    }
+
+    [SysAbiExport(Nid = "cG1VE2HMl6c", ExportName = "_ZN3sce4Json6StringD1Ev",
+        Target = Generation.Gen4 | Generation.Gen5, LibraryName = "libSceJson")]
+    public static int StringDestructor(CpuContext ctx)
+    {
+        JsonObjectHeap.RemoveString(ctx[CpuRegister.Rdi]);
+        return ReturnVoid(ctx);
+    }
+}

src/SharpEmu.Libs/Json/JsonValueModel.cs

@@ -0,0 +1,110 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Collections.Concurrent;
+
+namespace SharpEmu.Libs.Json;
+
+// sce::Json::Value is an opaque variant type (null / bool / signed / unsigned / real / string /
+// array / object). Games build one, populate it through set()/ctors and later serialize it. We
+// model the payload host-side keyed by the guest `this` pointer instead of writing into the guest
+// object: the object is often stack-allocated and its real byte layout is unknown, so writing a
+// guessed layout risks smashing an adjacent stack canary (the same failure the AudioOut2 context
+// param sizing note in this project already ran into). The guest reaches the payload only through
+// libSceJson methods, so shadowing by address is enough for the build path.
+internal enum JsonValueKind : byte
+{
+    Null = 0,
+    Boolean = 1,
+    Integer = 2,
+    UInteger = 3,
+    Real = 4,
+    String = 5,
+
+    // set(ValueType) / Value(ValueType): the guest chose the type itself. We keep its raw enum
+    // value verbatim rather than mapping it, because the canonical ValueType constants are not
+    // known from clean-room evidence and round-tripping the guest's own value is what matters.
+    ExplicitType = 6,
+}
+
+internal readonly struct JsonValueState
+{
+    private JsonValueState(
+        JsonValueKind kind,
+        bool boolean = false,
+        long integer = 0,
+        ulong unsignedInteger = 0,
+        double real = 0,
+        string? text = null,
+        uint explicitType = 0)
+    {
+        Kind = kind;
+        Boolean = boolean;
+        Integer = integer;
+        UnsignedInteger = unsignedInteger;
+        Real = real;
+        Text = text;
+        ExplicitType = explicitType;
+    }
+
+    public JsonValueKind Kind { get; }
+    public bool Boolean { get; }
+    public long Integer { get; }
+    public ulong UnsignedInteger { get; }
+    public double Real { get; }
+    public string? Text { get; }
+    public uint ExplicitType { get; }
+
+    public static JsonValueState Null { get; } = new(JsonValueKind.Null);
+
+    public static JsonValueState FromBoolean(bool value) => new(JsonValueKind.Boolean, boolean: value);
+
+    public static JsonValueState FromInteger(long value) => new(JsonValueKind.Integer, integer: value);
+
+    public static JsonValueState FromUnsignedInteger(ulong value) =>
+        new(JsonValueKind.UInteger, unsignedInteger: value);
+
+    public static JsonValueState FromReal(double value) => new(JsonValueKind.Real, real: value);
+
+    public static JsonValueState FromString(string value) => new(JsonValueKind.String, text: value);
+
+    public static JsonValueState FromExplicitType(uint value) =>
+        new(JsonValueKind.ExplicitType, explicitType: value);
+}
+
+// Shared host-side heap for the libSceJson object shadows. Keyed by the guest object address;
+// constructors overwrite and destructors remove, so guest stack-address reuse stays correct.
+internal static class JsonObjectHeap
+{
+    public static ConcurrentDictionary<ulong, JsonValueState> Values { get; } = new();
+
+    public static ConcurrentDictionary<ulong, string> Strings { get; } = new();
+
+    // Guest function the library should call when a Value is read as the wrong type. This HLE
+    // never dereferences missing members (shadows degrade to defaults), so the hook is stored for
+    // fidelity but not invoked.
+    public static ulong GlobalNullAccessCallback;
+
+    public static ulong GlobalNullAccessCallbackContext;
+
+    public static void SetValue(ulong address, JsonValueState state) => Values[address] = state;
+
+    public static void RemoveValue(ulong address) => Values.TryRemove(address, out _);
+
+    public static void SetString(ulong address, string text) => Strings[address] = text;
+
+    public static void RemoveString(ulong address) => Strings.TryRemove(address, out _);
+
+    // A missing shadow (temporary the compiler built without an out-of-line ctor, or a copy we did
+    // not track) degrades to the empty string rather than faulting.
+    public static string GetStringOrEmpty(ulong address) =>
+        Strings.TryGetValue(address, out var text) ? text : string.Empty;
+
+    internal static void ResetForTests()
+    {
+        Values.Clear();
+        Strings.Clear();
+        GlobalNullAccessCallback = 0;
+        GlobalNullAccessCallbackContext = 0;
+    }
+}

src/SharpEmu.Libs/Kernel/KernelEventFlagCompatExports.cs

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 using System.Collections.Concurrent;
+using System.Diagnostics;
 using System.Text;
 using SharpEmu.HLE;
 using SharpEmu.Libs.Fiber;
@@ -33,6 +34,45 @@ public static class KernelEventFlagCompatExports
         public object Gate { get; } = new();
     }
 
+    private sealed class EventFlagWaiter : IGuestThreadBlockWaiter
+    {
+        public required CpuContext Ctx { get; init; }
+        public required EventFlagState State { get; init; }
+        public required ulong Pattern { get; init; }
+        public required uint WaitMode { get; init; }
+        public required ulong ResultAddress { get; init; }
+        public bool Timed { get; init; }
+
+        // Timed-wait completion state; unused when Timed is false.
+        public ulong TimeoutAddress { get; init; }
+        public long DeadlineTimestamp { get; init; }
+
+        public OrbisGen2Result? Result { get; set; }
+
+        // Untimed waits stash the prepared result here at wake and return it at resume.
+        private OrbisGen2Result _blockedResult = OrbisGen2Result.ORBIS_GEN2_OK;
+
+        public int Resume() => Timed
+            ? CompleteBlockedTimedWait(Ctx, State, this, Pattern, WaitMode, ResultAddress, TimeoutAddress, DeadlineTimestamp)
+            : (int)_blockedResult;
+
+        public bool TryWake()
+        {
+            if (Timed)
+            {
+                return TryCompleteBlockedTimedWait(Ctx, State, this, Pattern, WaitMode, ResultAddress);
+            }
+
+            if (!TryPrepareBlockedWait(Ctx, State, Pattern, WaitMode, ResultAddress, out var preparedResult))
+            {
+                return false;
+            }
+
+            _blockedResult = preparedResult;
+            return true;
+        }
+    }
+
     [SysAbiExport(
         Nid = "BpFoboUJoZU",
         ExportName = "sceKernelCreateEventFlag",
@@ -233,36 +273,59 @@ public static class KernelEventFlagCompatExports
 
             if (timeoutAddress != 0)
             {
+                if (timeoutUsec == 0)
+                {
+                    _ = ctx.TryWriteUInt32(timeoutAddress, 0);
+                    _ = TryWriteResultPattern(ctx, resultAddress, state.Bits);
+                    TraceEventFlag($"wait-timeout handle=0x{handle:X16} pattern=0x{pattern:X16} timeout=0 ret=0x{returnRip:X16}");
+                    return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_TIMED_OUT);
+                }
+
+                var deadline = GuestThreadExecution.ComputeDeadlineTimestamp(
+                    TimeSpan.FromTicks((long)timeoutUsec * 10L));
+                var timedWaiter = new EventFlagWaiter
+                {
+                    Ctx = ctx,
+                    State = state,
+                    Pattern = pattern,
+                    WaitMode = waitMode,
+                    ResultAddress = resultAddress,
+                    Timed = true,
+                    TimeoutAddress = timeoutAddress,
+                    DeadlineTimestamp = deadline,
+                };
+                if (GuestThreadExecution.RequestCurrentThreadBlock(
+                        ctx,
+                        "sceKernelWaitEventFlag",
+                        GetEventFlagWakeKey(handle),
+                        timedWaiter,
+                        blockDeadlineTimestamp: deadline))
+                {
+                    state.WaitingThreads++;
+                    TraceEventFlag($"wait-block-timed handle=0x{handle:X16} pattern=0x{pattern:X16} timeout={timeoutUsec} waiters={state.WaitingThreads} ret=0x{returnRip:X16}");
+                    return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_OK);
+                }
+
                 _ = ctx.TryWriteUInt32(timeoutAddress, 0);
                 _ = TryWriteResultPattern(ctx, resultAddress, state.Bits);
-                TraceEventFlag($"wait-timeout handle=0x{handle:X16} pattern=0x{pattern:X16} timeout={timeoutUsec} ret=0x{returnRip:X16}");
+                TraceEventFlag($"wait-timeout-host handle=0x{handle:X16} pattern=0x{pattern:X16} timeout={timeoutUsec} ret=0x{returnRip:X16}");
                 return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_TIMED_OUT);
             }
 
             var currentGuestThread = GuestThreadExecution.CurrentGuestThreadHandle;
             var currentFiber = FiberExports.GetCurrentFiberAddressForDiagnostics(ctx);
             var managedThread = Environment.CurrentManagedThreadId;
-            var blockedWaitResult = OrbisGen2Result.ORBIS_GEN2_OK;
             var requestedBlock = GuestThreadExecution.RequestCurrentThreadBlock(
                 ctx,
                 "sceKernelWaitEventFlag",
                 GetEventFlagWakeKey(handle),
-                () => (int)blockedWaitResult,
-                () =>
+                new EventFlagWaiter
                 {
-                    if (!TryPrepareBlockedWait(
-                            ctx,
-                            state,
-                            pattern,
-                            waitMode,
-                            resultAddress,
-                            out var preparedResult))
-                    {
-                        return false;
-                    }
-
-                    blockedWaitResult = preparedResult;
-                    return true;
+                    Ctx = ctx,
+                    State = state,
+                    Pattern = pattern,
+                    WaitMode = waitMode,
+                    ResultAddress = resultAddress,
                 });
             TraceEventFlag($"wait-unsatisfied handle=0x{handle:X16} pattern=0x{pattern:X16} bits=0x{state.Bits:X16} guest_thread=0x{currentGuestThread:X16} fiber=0x{currentFiber:X16} managed={managedThread} block={requestedBlock} ret=0x{returnRip:X16} frames={FormatFrameChain(ctx)}");
             TraceEventFlag($"wait-object handle=0x{handle:X16} name='{state.Name}' {FormatGuestWaitObject(ctx)}");
@@ -446,6 +509,92 @@ public static class KernelEventFlagCompatExports
         }
     }
 
+    private static bool TryCompleteBlockedTimedWait(
+        CpuContext ctx,
+        EventFlagState state,
+        EventFlagWaiter waiter,
+        ulong pattern,
+        uint waitMode,
+        ulong resultAddress)
+    {
+        lock (state.Gate)
+        {
+            if (waiter.Result is not null)
+            {
+                return true;
+            }
+
+            if (!IsSatisfied(state.Bits, pattern, waitMode))
+            {
+                return false;
+            }
+
+            waiter.Result = TryWriteResultPattern(ctx, resultAddress, state.Bits)
+                ? OrbisGen2Result.ORBIS_GEN2_OK
+                : OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+            if (waiter.Result == OrbisGen2Result.ORBIS_GEN2_OK)
+            {
+                ApplyClearMode(state, pattern, waitMode);
+            }
+
+            state.WaitingThreads = Math.Max(0, state.WaitingThreads - 1);
+            return true;
+        }
+    }
+
+    private static int CompleteBlockedTimedWait(
+        CpuContext ctx,
+        EventFlagState state,
+        EventFlagWaiter waiter,
+        ulong pattern,
+        uint waitMode,
+        ulong resultAddress,
+        ulong timeoutAddress,
+        long deadlineTimestamp)
+    {
+        lock (state.Gate)
+        {
+            if (waiter.Result is null)
+            {
+                if (IsSatisfied(state.Bits, pattern, waitMode))
+                {
+                    waiter.Result = TryWriteResultPattern(ctx, resultAddress, state.Bits)
+                        ? OrbisGen2Result.ORBIS_GEN2_OK
+                        : OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+                    if (waiter.Result == OrbisGen2Result.ORBIS_GEN2_OK)
+                    {
+                        ApplyClearMode(state, pattern, waitMode);
+                    }
+                }
+                else
+                {
+                    waiter.Result = TryWriteResultPattern(ctx, resultAddress, state.Bits)
+                        ? OrbisGen2Result.ORBIS_GEN2_ERROR_TIMED_OUT
+                        : OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+                }
+
+                state.WaitingThreads = Math.Max(0, state.WaitingThreads - 1);
+            }
+        }
+
+        if (waiter.Result == OrbisGen2Result.ORBIS_GEN2_OK)
+        {
+            var remainingTicks = deadlineTimestamp - Stopwatch.GetTimestamp();
+            var remainingMicros = remainingTicks <= 0
+                ? 0u
+                : (uint)Math.Min(
+                    uint.MaxValue,
+                    remainingTicks / (double)Stopwatch.Frequency * 1_000_000d);
+            _ = ctx.TryWriteUInt32(timeoutAddress, remainingMicros);
+        }
+        else
+        {
+            _ = ctx.TryWriteUInt32(timeoutAddress, 0);
+        }
+
+        return (int)waiter.Result.Value;
+    }
+
     private static string GetEventFlagWakeKey(ulong handle) =>
         $"event_flag:0x{handle:X16}";
 

src/SharpEmu.Libs/Kernel/KernelEventQueueCompatExports.cs

@@ -2,7 +2,9 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 using SharpEmu.HLE;
+using System.Buffers;
 using System.Buffers.Binary;
+using System.Collections.Concurrent;
 using System.Threading;
 
 namespace SharpEmu.Libs.Kernel;
@@ -17,7 +19,7 @@ public static class KernelEventQueueCompatExports
 
     private static readonly object _eventQueueGate = new();
     private static readonly HashSet<ulong> _eventQueues = new();
-    private static readonly Dictionary<ulong, LinkedList<KernelQueuedEvent>> _pendingEvents = new();
+    private static readonly Dictionary<ulong, KernelEventDeque> _pendingEvents = new();
     private static readonly Dictionary<ulong, Dictionary<(ulong Ident, short Filter), KernelEventRegistration>> _registeredEvents = new();
     private static long _nextEventQueueHandle = 1;
 
@@ -34,6 +36,76 @@ public static class KernelEventQueueCompatExports
         short Filter,
         ulong UserData);
 
+    // Grow-only ring buffer standing in for LinkedList<KernelQueuedEvent>, which
+    // allocated a node per enqueue — steady churn at one enqueue per vblank/flip edge
+    // per registered queue. Mutated only under _eventQueueGate.
+    private sealed class KernelEventDeque
+    {
+        private KernelQueuedEvent[] _items = new KernelQueuedEvent[4];
+        private int _head;
+
+        public int Count { get; private set; }
+
+        public KernelQueuedEvent this[int index]
+        {
+            get => _items[(_head + index) % _items.Length];
+            set => _items[(_head + index) % _items.Length] = value;
+        }
+
+        public void AddLast(in KernelQueuedEvent item)
+        {
+            if (Count == _items.Length)
+            {
+                var grown = new KernelQueuedEvent[_items.Length * 2];
+                for (var i = 0; i < Count; i++)
+                {
+                    grown[i] = this[i];
+                }
+
+                _items = grown;
+                _head = 0;
+            }
+
+            _items[(_head + Count) % _items.Length] = item;
+            Count++;
+        }
+
+        public KernelQueuedEvent RemoveFirst()
+        {
+            var value = _items[_head];
+            _head = (_head + 1) % _items.Length;
+            Count--;
+            return value;
+        }
+
+        public int FindIndex(ulong ident, short filter)
+        {
+            for (var i = 0; i < Count; i++)
+            {
+                var candidate = this[i];
+                if (candidate.Ident == ident && candidate.Filter == filter)
+                {
+                    return i;
+                }
+            }
+
+            return -1;
+        }
+    }
+
+    private sealed class EqueueWaiter : IGuestThreadBlockWaiter
+    {
+        public required CpuContext Ctx { get; init; }
+        public required ulong Handle { get; init; }
+        public required ulong EventsAddress { get; init; }
+        public required int EventCapacity { get; init; }
+        public required ulong OutCountAddress { get; init; }
+
+        public int Resume() => ResumeWaitEqueue(Ctx, Handle, EventsAddress, EventCapacity, OutCountAddress);
+
+        public bool TryWake() => HasPendingEvents(Handle);
+    }
+
     [SysAbiExport(
         Nid = "D0OdFMjp46I",
         ExportName = "sceKernelCreateEqueue",
@@ -51,7 +123,7 @@ public static class KernelEventQueueCompatExports
         lock (_eventQueueGate)
         {
             _eventQueues.Add(handle);
-            _pendingEvents[handle] = new LinkedList<KernelQueuedEvent>();
+            _pendingEvents[handle] = new KernelEventDeque();
             _registeredEvents[handle] = new Dictionary<(ulong Ident, short Filter), KernelEventRegistration>();
         }
 
@@ -79,6 +151,8 @@ public static class KernelEventQueueCompatExports
             _registeredEvents.Remove(handle);
         }
 
+        _wakeKeys.TryRemove(handle, out _);
+
         TraceEventQueue(ctx, "delete", handle);
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
@@ -343,8 +417,14 @@ public static class KernelEventQueueCompatExports
                 ctx,
                 "sceKernelWaitEqueue",
                 GetEventQueueWakeKey(handle),
-                () => ResumeWaitEqueue(ctx, handle, eventsAddress, eventCapacity, outCountAddress),
-                () => HasPendingEvents(handle)))
+                new EqueueWaiter
+                {
+                    Ctx = ctx,
+                    Handle = handle,
+                    EventsAddress = eventsAddress,
+                    EventCapacity = eventCapacity,
+                    OutCountAddress = outCountAddress,
+                }))
         {
             TraceEventQueue(ctx, "wait-block", handle);
             return (int)OrbisGen2Result.ORBIS_GEN2_OK;
@@ -409,7 +489,7 @@ public static class KernelEventQueueCompatExports
 
             if (!_pendingEvents.TryGetValue(handle, out var queue))
             {
-                queue = new LinkedList<KernelQueuedEvent>();
+                queue = new KernelEventDeque();
                 _pendingEvents[handle] = queue;
             }
 
@@ -480,7 +560,7 @@ public static class KernelEventQueueCompatExports
 
                 if (!_pendingEvents.TryGetValue(handle, out var queue))
                 {
-                    queue = new LinkedList<KernelQueuedEvent>();
+                    queue = new KernelEventDeque();
                     _pendingEvents[handle] = queue;
                 }
 
@@ -527,7 +607,7 @@ public static class KernelEventQueueCompatExports
 
             if (!_pendingEvents.TryGetValue(handle, out var queue))
             {
-                queue = new LinkedList<KernelQueuedEvent>();
+                queue = new KernelEventDeque();
                 _pendingEvents[handle] = queue;
             }
 
@@ -563,15 +643,15 @@ public static class KernelEventQueueCompatExports
 
             if (!_pendingEvents.TryGetValue(handle, out var events))
             {
-                events = new LinkedList<KernelQueuedEvent>();
+                events = new KernelEventDeque();
                 _pendingEvents[handle] = events;
             }
 
             var count = 1UL;
-            var pendingNode = FindPendingEvent(events, ident, filter);
-            if (pendingNode is not null)
+            var pendingIndex = events.FindIndex(ident, filter);
+            if (pendingIndex >= 0)
             {
-                count = Math.Min(((pendingNode.Value.Data >> 12) & 0xFUL) + 1, 0xFUL);
+                count = Math.Min(((events[pendingIndex].Data >> 12) & 0xFUL) + 1, 0xFUL);
             }
 
             var timeBits = unchecked((ulong)Environment.TickCount64) & 0xFFFUL;
@@ -584,9 +664,9 @@ public static class KernelEventQueueCompatExports
                 eventData,
                 userData);
 
-            if (pendingNode is not null)
+            if (pendingIndex >= 0)
             {
-                pendingNode.Value = triggeredEvent;
+                events[pendingIndex] = triggeredEvent;
             }
             else
             {
@@ -631,40 +711,28 @@ public static class KernelEventQueueCompatExports
     }
 
     private static void QueueOrUpdateEvent(
-        LinkedList<KernelQueuedEvent> queue,
+        KernelEventDeque queue,
         KernelQueuedEvent queuedEvent)
     {
-        var pendingNode = FindPendingEvent(queue, queuedEvent.Ident, queuedEvent.Filter);
-        if (pendingNode is null)
+        var pendingIndex = queue.FindIndex(queuedEvent.Ident, queuedEvent.Filter);
+        if (pendingIndex < 0)
         {
             queue.AddLast(queuedEvent);
             return;
         }
 
-        pendingNode.Value = queuedEvent with
+        queue[pendingIndex] = queuedEvent with
         {
-            Fflags = Math.Max(pendingNode.Value.Fflags + 1, queuedEvent.Fflags),
+            Fflags = Math.Max(queue[pendingIndex].Fflags + 1, queuedEvent.Fflags),
         };
     }
 
-    private static LinkedListNode<KernelQueuedEvent>? FindPendingEvent(
-        LinkedList<KernelQueuedEvent> queue,
-        ulong ident,
-        short filter)
-    {
-        for (var node = queue.First; node is not null; node = node.Next)
-        {
-            if (node.Value.Ident == ident && node.Value.Filter == filter)
-            {
-                return node;
-            }
-        }
-
-        return null;
-    }
+    // Wake keys are formatted once per handle: WakeEventQueue runs on every event
+    // enqueue (vblank/flip edges included), so formatting there is steady string churn.
+    private static readonly ConcurrentDictionary<ulong, string> _wakeKeys = new();
 
     private static string GetEventQueueWakeKey(ulong handle) =>
-        $"sceKernelWaitEqueue:{handle:X16}";
+        _wakeKeys.GetOrAdd(handle, static h => $"sceKernelWaitEqueue:{h:X16}");
 
     private static void WakeEventQueue(ulong handle)
     {
@@ -678,7 +746,10 @@ public static class KernelEventQueueCompatExports
             return 0;
         }
 
+        // Engines wait on the vblank/flip equeue every frame, so the delivery buffer
+        // (usually a single event) comes from the pool instead of a per-call array.
         KernelQueuedEvent[] events;
+        int count;
         lock (_eventQueueGate)
         {
             if (!_pendingEvents.TryGetValue(handle, out var queue) || queue.Count == 0)
@@ -686,24 +757,30 @@ public static class KernelEventQueueCompatExports
                 return 0;
             }
 
-            var count = Math.Min(eventCapacity, queue.Count);
-            events = new KernelQueuedEvent[count];
+            count = Math.Min(eventCapacity, queue.Count);
+            events = ArrayPool<KernelQueuedEvent>.Shared.Rent(count);
             for (var i = 0; i < count; i++)
             {
-                events[i] = queue.First!.Value;
-                queue.RemoveFirst();
+                events[i] = queue.RemoveFirst();
             }
         }
 
-        for (var i = 0; i < events.Length; i++)
+        try
         {
-            if (!WriteKernelEvent(ctx, eventsAddress + ((ulong)i * KernelEventSize), events[i]))
+            for (var i = 0; i < count; i++)
             {
-                return i;
+                if (!WriteKernelEvent(ctx, eventsAddress + ((ulong)i * KernelEventSize), events[i]))
+                {
+                    return i;
+                }
             }
         }
+        finally
+        {
+            ArrayPool<KernelQueuedEvent>.Shared.Return(events);
+        }
 
-        return events.Length;
+        return count;
     }
 
     private static bool WriteKernelEvent(CpuContext ctx, ulong address, KernelQueuedEvent queuedEvent)
@@ -718,9 +795,12 @@ public static class KernelEventQueueCompatExports
         return ctx.Memory.TryWrite(address, eventBytes);
     }
 
+    private static readonly bool _logEqueue =
+        string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_EQUEUE"), "1", StringComparison.Ordinal);
+
     private static void TraceEventQueue(CpuContext ctx, string operation, ulong handle)
     {
-        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_EQUEUE"), "1", StringComparison.Ordinal))
+        if (!_logEqueue)
         {
             return;
         }

src/SharpEmu.Libs/Kernel/KernelMemoryCompatExports.cs

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 using SharpEmu.HLE;
+using SharpEmu.HLE.Host;
 using SharpEmu.Libs.Ampr;
 using System.Buffers;
 using System.Buffers.Binary;
@@ -17,6 +18,10 @@ public static class KernelMemoryCompatExports
     private const int MaxGuestStringLength = 4096;
     private const int WideCharSize = sizeof(ushort);
     private const int MemsetChunkSize = 16 * 1024;
+    private const int MemcpyChunkSize = 256 * 1024;
+
+    // Shared all-zero scratch for chunked zero-fill loops; never written to.
+    private static readonly byte[] _zeroChunk = new byte[MemsetChunkSize];
     private const int TlsModuleBlockSize = 0x10000;
     private const int O_WRONLY = 0x1;
     private const int O_RDWR = 0x2;
@@ -52,14 +57,13 @@ public static class KernelMemoryCompatExports
     private const ulong FlexibleMemorySizeBytes = 448UL * 1024 * 1024;
     private const int OrbisVirtualQueryInfoSize = 72;
     private const int OrbisKernelMaximumNameLength = 32;
-    private const uint MemCommit = 0x1000;
-    private const uint MemReserve = 0x2000;
-    private const uint MemRelease = 0x8000;
+    // Raw Windows PAGE_* values used only against HostRegionInfo.RawProtection,
+    // which by contract carries the untranslated protection word of the host
+    // platform in use (see IHostMemory).
     private const uint HostPageNoAccess = 0x01;
     private const uint HostPageReadOnly = 0x02;
     private const uint HostPageReadWrite = 0x04;
     private const uint HostPageWriteCopy = 0x08;
-    private const uint HostPageExecute = 0x10;
     private const uint HostPageExecuteRead = 0x20;
     private const uint HostPageExecuteReadWrite = 0x40;
     private const uint HostPageExecuteWriteCopy = 0x80;
@@ -136,31 +140,9 @@ public static class KernelMemoryCompatExports
     private static string? _cachedApp0Root;
     private static string? _cachedDownload0Root;
 
-    [StructLayout(LayoutKind.Sequential)]
-    private struct MemoryBasicInformation
-    {
-        public nint BaseAddress;
-        public nint AllocationBase;
-        public uint AllocationProtect;
-        public nuint RegionSize;
-        public uint State;
-        public uint Protect;
-        public uint Type;
-    }
-
-    [DllImport("kernel32.dll", SetLastError = true)]
-    private static extern nuint VirtualQuery(nint lpAddress, out MemoryBasicInformation lpBuffer, nuint dwLength);
-
-    [DllImport("kernel32.dll", SetLastError = true)]
-    [return: MarshalAs(UnmanagedType.Bool)]
-    private static extern bool VirtualProtect(nint lpAddress, nuint dwSize, uint flNewProtect, out uint lpflOldProtect);
-
-    [DllImport("kernel32.dll", SetLastError = true)]
-    private static extern nint VirtualAlloc(nint lpAddress, nuint dwSize, uint flAllocationType, uint flProtect);
-
-    [DllImport("kernel32.dll", SetLastError = true)]
-    [return: MarshalAs(UnmanagedType.Bool)]
-    private static extern bool VirtualFree(nint lpAddress, nuint dwSize, uint dwFreeType);
+    // Property (not a cached field) so merely touching this type never resolves
+    // the platform backend; non-Windows hosts only throw if a call is reached.
+    private static IHostMemory HostMemory => HostPlatform.Current.Memory;
 
     private sealed class OpenDirectory
     {
@@ -200,6 +182,40 @@ public static class KernelMemoryCompatExports
         }
     }
 
+    public static bool TryUnregisterGuestPathMount(string guestMountPoint)
+    {
+        if (string.IsNullOrWhiteSpace(guestMountPoint))
+        {
+            return false;
+        }
+
+        var normalizedMountPoint = NormalizeGuestStatCachePath(guestMountPoint);
+        if (normalizedMountPoint is null || normalizedMountPoint == "/")
+        {
+            return false;
+        }
+
+        var removed = false;
+        lock (_guestMountGate)
+        {
+            removed = _guestMounts.Remove(normalizedMountPoint);
+        }
+
+        if (!removed)
+        {
+            return false;
+        }
+
+        lock (_statCacheGate)
+        {
+            _negativeStatCache.RemoveWhere(path =>
+                string.Equals(path, normalizedMountPoint, StringComparison.OrdinalIgnoreCase) ||
+                path.StartsWith(normalizedMountPoint + "/", StringComparison.OrdinalIgnoreCase));
+        }
+
+        return true;
+    }
+
     internal static bool TryAllocateHleData(
         CpuContext ctx,
         ulong length,
@@ -243,11 +259,10 @@ public static class KernelMemoryCompatExports
                 DirectStart: 0);
         }
 
-        var zeroes = new byte[(int)Math.Min(mappedLength, (ulong)MemsetChunkSize)];
         for (ulong offset = 0; offset < mappedLength;)
         {
-            var chunkLength = (int)Math.Min((ulong)zeroes.Length, mappedLength - offset);
-            if (!ctx.Memory.TryWrite(address + offset, zeroes.AsSpan(0, chunkLength)))
+            var chunkLength = (int)Math.Min((ulong)_zeroChunk.Length, mappedLength - offset);
+            if (!ctx.Memory.TryWrite(address + offset, _zeroChunk.AsSpan(0, chunkLength)))
             {
                 return false;
             }
@@ -410,33 +425,50 @@ public static class KernelMemoryCompatExports
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
         }
 
-        var chunk = new byte[MemsetChunkSize];
-        Array.Fill(chunk, value);
-        var remaining = length;
-        var cursor = destination;
-        while (remaining > 0)
+        // Rent may hand back a larger array than requested; only the first chunkLength
+        // bytes are filled, so the loop must cap at chunkLength rather than chunk.Length.
+        var chunkLength = (int)Math.Min(length, (ulong)MemsetChunkSize);
+        var chunk = value == 0 ? _zeroChunk : ArrayPool<byte>.Shared.Rent(chunkLength);
+        if (value != 0)
         {
-            var take = (int)Math.Min((ulong)chunk.Length, remaining);
-            if (!TryWriteCompat(ctx, cursor, chunk.AsSpan(0, take)))
+            chunk.AsSpan(0, chunkLength).Fill(value);
+        }
+
+        try
+        {
+            var remaining = length;
+            var cursor = destination;
+            while (remaining > 0)
             {
-                if (length <= 0x40)
+                var take = (int)Math.Min((ulong)chunkLength, remaining);
+                if (!TryWriteCompat(ctx, cursor, chunk.AsSpan(0, take)))
                 {
-                    var recoveryIndex = Interlocked.Increment(ref _inaccessibleMemsetRecoveryCount);
-                    if (recoveryIndex <= 8)
+                    if (length <= 0x40)
                     {
-                        Console.Error.WriteLine(
-                            $"[LOADER][WARNING] memset inaccessible-dst recovery#{recoveryIndex}: rip=0x{ctx.Rip:X16} dst=0x{destination:X16} len=0x{length:X} val=0x{value:X2}");
+                        var recoveryIndex = Interlocked.Increment(ref _inaccessibleMemsetRecoveryCount);
+                        if (recoveryIndex <= 8)
+                        {
+                            Console.Error.WriteLine(
+                                $"[LOADER][WARNING] memset inaccessible-dst recovery#{recoveryIndex}: rip=0x{ctx.Rip:X16} dst=0x{destination:X16} len=0x{length:X} val=0x{value:X2}");
+                        }
+
+                        ctx[CpuRegister.Rax] = destination;
+                        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
                     }
 
-                    ctx[CpuRegister.Rax] = destination;
-                    return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+                    return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
                 }
 
-                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+                cursor += (ulong)take;
+                remaining -= (ulong)take;
+            }
+        }
+        finally
+        {
+            if (value != 0)
+            {
+                ArrayPool<byte>.Shared.Return(chunk);
             }
-
-            cursor += (ulong)take;
-            remaining -= (ulong)take;
         }
 
         ctx[CpuRegister.Rax] = destination;
@@ -1173,11 +1205,10 @@ public static class KernelMemoryCompatExports
         var rawCount = ctx[CpuRegister.Rdx];
 
         // A garbage/absurd count (observed as e.g. 0xA7560035 from the same still-unidentified
-        // upstream bug that also feeds bad lengths to memset) must not reach
-        // GC.AllocateUninitializedArray: attempting a multi-GB allocation from a guest-thread
-        // call context corrupted the CLR outright ("Invalid Program: attempted to call a
-        // UnmanagedCallersOnly method from managed code") instead of throwing a normal
-        // exception. Reject anything above a sane bound before allocating.
+        // upstream bug that also feeds bad lengths to memset) must not turn into a multi-GB
+        // copy attempt from a guest-thread call context, which corrupted the CLR outright
+        // ("Invalid Program: attempted to call a UnmanagedCallersOnly method from managed
+        // code") instead of throwing a normal exception. Reject anything above a sane bound.
         const ulong maxSaneCount = 512UL * 1024 * 1024;
         if (rawCount > maxSaneCount)
         {
@@ -1186,15 +1217,52 @@ public static class KernelMemoryCompatExports
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
         }
 
-        var count = (int)rawCount;
-        var payload = GC.AllocateUninitializedArray<byte>(count);
-        if (count > 0 && (!TryReadCompat(ctx, source, payload) || !TryWriteCompat(ctx, destination, payload)))
+        ctx[CpuRegister.Rax] = destination;
+        if (rawCount == 0)
         {
-            ctx[CpuRegister.Rax] = destination;
-            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+            return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+        }
+
+        // Cap iterations at the requested chunk size, not chunk.Length: Rent may hand
+        // back a larger array, and the copy granularity should not depend on pool
+        // bucketing internals.
+        var chunkLength = (int)Math.Min(rawCount, (ulong)MemcpyChunkSize);
+        var chunk = ArrayPool<byte>.Shared.Rent(chunkLength);
+        try
+        {
+            // memmove aliases this export, so overlapping ranges must survive the chunked
+            // copy: when the destination starts inside the source range, copy high-to-low
+            // so no source byte is overwritten before it has been read.
+            var copyBackward = destination > source && destination - source < rawCount;
+            var remaining = rawCount;
+            ulong offset = copyBackward ? rawCount : 0;
+            while (remaining > 0)
+            {
+                var take = (int)Math.Min((ulong)chunkLength, remaining);
+                if (copyBackward)
+                {
+                    offset -= (ulong)take;
+                }
+
+                var span = chunk.AsSpan(0, take);
+                if (!TryReadCompat(ctx, source + offset, span) || !TryWriteCompat(ctx, destination + offset, span))
+                {
+                    return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+                }
+
+                if (!copyBackward)
+                {
+                    offset += (ulong)take;
+                }
+
+                remaining -= (ulong)take;
+            }
+        }
+        finally
+        {
+            ArrayPool<byte>.Shared.Return(chunk);
         }
 
-        ctx[CpuRegister.Rax] = destination;
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
@@ -1822,6 +1890,45 @@ public static class KernelMemoryCompatExports
         }
     }
 
+    [SysAbiExport(
+        Nid = "fgIsQ10xYVA",
+        ExportName = "sceKernelChmod",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelChmod(CpuContext ctx)
+    {
+        var pathAddress = ctx[CpuRegister.Rdi];
+        var mode = unchecked((uint)ctx[CpuRegister.Rsi]);
+        if (pathAddress == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        if (!TryReadNullTerminatedUtf8(ctx, pathAddress, MaxGuestStringLength, out var guestPath))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        var hostPath = ResolveGuestPath(guestPath);
+        if (IsReadOnlyGuestMutationPath(guestPath))
+        {
+            LogOpenTrace($"chmod readonly path='{guestPath}' host='{hostPath}' mode=0x{mode:X}");
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_PERMISSION_DENIED;
+        }
+
+        if (!File.Exists(hostPath) && !Directory.Exists(hostPath))
+        {
+            AddNegativeStatCacheForGuestPath(guestPath);
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+        }
+
+        // POSIX permission bits have no host equivalent on Windows; accept the call
+        // so guests that chmod their freshly created files/directories can proceed.
+        LogOpenTrace($"chmod path='{guestPath}' host='{hostPath}' mode=0x{mode:X}");
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
     [SysAbiExport(
         Nid = "NNtFaKJbPt0",
         ExportName = "_close",
@@ -3529,7 +3636,7 @@ public static class KernelMemoryCompatExports
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
         }
 
-        if (!TryProtectHostRange(alignedAddress, alignedLength, protection))
+        if (!TryProtectHostRange(ctx, alignedAddress, alignedLength, protection))
         {
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
         }
@@ -3563,7 +3670,7 @@ public static class KernelMemoryCompatExports
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
         }
 
-        if (!TryProtectHostRange(alignedAddress, alignedLength, protection))
+        if (!TryProtectHostRange(ctx, alignedAddress, alignedLength, protection))
         {
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
         }
@@ -5763,42 +5870,40 @@ public static class KernelMemoryCompatExports
         return alignedLength != 0;
     }
 
-    private static bool TryProtectHostRange(ulong address, ulong length, int orbisProtection)
+    private static bool TryProtectHostRange(CpuContext ctx, ulong address, ulong length, int orbisProtection)
     {
         if (length == 0 || length > nuint.MaxValue)
         {
             return false;
         }
 
-        var hostProtection = ResolveHostProtection(orbisProtection);
-        if (!VirtualProtect((nint)address, (nuint)length, hostProtection, out _))
+        if (!KernelVirtualRangeAllocator.TryResolveAddressSpace(ctx.Memory, out var addressSpace))
         {
             return false;
         }
 
-        return true;
+        return addressSpace.TryProtect(address, length, ResolveGuestProtection(orbisProtection));
     }
 
-    private static uint ResolveHostProtection(int orbisProtection)
+    private static GuestPageProtection ResolveGuestProtection(int orbisProtection)
     {
-        var read = (orbisProtection & (OrbisProtCpuRead | OrbisProtGpuRead)) != 0;
-        var write = (orbisProtection & (OrbisProtCpuWrite | OrbisProtGpuWrite)) != 0;
-        var execute = (orbisProtection & OrbisProtCpuExec) != 0;
-
-        if (execute)
+        var protection = GuestPageProtection.None;
+        if ((orbisProtection & (OrbisProtCpuRead | OrbisProtGpuRead)) != 0)
         {
-            return write
-                ? HostPageExecuteReadWrite
-                : read
-                    ? HostPageExecuteRead
-                    : HostPageExecute;
+            protection |= GuestPageProtection.Read;
         }
 
-        return write
-            ? HostPageReadWrite
-            : read
-                ? HostPageReadOnly
-                : HostPageNoAccess;
+        if ((orbisProtection & (OrbisProtCpuWrite | OrbisProtGpuWrite)) != 0)
+        {
+            protection |= GuestPageProtection.Write;
+        }
+
+        if ((orbisProtection & OrbisProtCpuExec) != 0)
+        {
+            protection |= GuestPageProtection.Execute;
+        }
+
+        return protection;
     }
 
     private static bool TryFindVirtualQueryRegionLocked(ulong queryAddress, bool findNext, out MappedRegion region)
@@ -6184,7 +6289,7 @@ public static class KernelMemoryCompatExports
             var effectiveAlignment = Math.Max(alignment, pageSize);
             var usableSize = checked((nuint)AlignUp((ulong)actualSize, (ulong)pageSize));
             var reservationSize = checked(pageSize + effectiveAlignment - 1 + usableSize + pageSize);
-            var baseAddress = VirtualAlloc(0, reservationSize, MemCommit | MemReserve, HostPageReadWrite);
+            var baseAddress = unchecked((nint)HostMemory.Allocate(0, reservationSize, HostPageProtection.ReadWrite));
             if (baseAddress == 0)
             {
                 return false;
@@ -6192,9 +6297,9 @@ public static class KernelMemoryCompatExports
 
             var alignedAddress = AlignUp(unchecked((ulong)baseAddress) + (ulong)pageSize, (ulong)effectiveAlignment);
             var guardAddress = alignedAddress + (ulong)usableSize;
-            if (!VirtualProtect((nint)guardAddress, pageSize, HostPageNoAccess, out _))
+            if (!HostMemory.Protect(guardAddress, pageSize, HostPageProtection.NoAccess, out _))
             {
-                _ = VirtualFree(baseAddress, 0, MemRelease);
+                _ = HostMemory.Free(unchecked((ulong)baseAddress));
                 return false;
             }
 
@@ -6329,7 +6434,7 @@ public static class KernelMemoryCompatExports
 
         if (allocation.IsGuarded)
         {
-            _ = VirtualFree(allocation.BaseAddress, 0, MemRelease);
+            _ = HostMemory.Free(unchecked((ulong)allocation.BaseAddress));
         }
         else
         {
@@ -6425,7 +6530,7 @@ public static class KernelMemoryCompatExports
             return false;
         }
 
-        if (!TryQueryHostPage(address, out var startInfo) || !HasRequiredProtection(startInfo.Protect, writeAccess))
+        if (!TryQueryHostPage(address, out var startInfo) || !HasRequiredProtection(startInfo.RawProtection, writeAccess))
         {
             return false;
         }
@@ -6436,7 +6541,7 @@ public static class KernelMemoryCompatExports
             return true;
         }
 
-        if (!TryQueryHostPage(endAddress, out var endInfo) || !HasRequiredProtection(endInfo.Protect, writeAccess))
+        if (!TryQueryHostPage(endAddress, out var endInfo) || !HasRequiredProtection(endInfo.RawProtection, writeAccess))
         {
             return false;
         }
@@ -6444,16 +6549,14 @@ public static class KernelMemoryCompatExports
         return true;
     }
 
-    private static bool TryQueryHostPage(ulong address, out MemoryBasicInformation info)
+    private static bool TryQueryHostPage(ulong address, out HostRegionInfo info)
     {
-        info = default;
-        var size = (nuint)Marshal.SizeOf<MemoryBasicInformation>();
-        if (VirtualQuery((nint)address, out info, size) == 0)
+        if (!HostMemory.Query(address, out info))
         {
             return false;
         }
 
-        return info.State == MemCommit;
+        return info.State == HostRegionState.Committed;
     }
 
     private static bool HasRequiredProtection(uint protect, bool writeAccess)
@@ -6947,15 +7050,4 @@ public static class KernelMemoryCompatExports
         sum = left + right;
         return sum >= left;
     }
-
-    [SysAbiExport(
-        Nid = "KMcEa+rHsIo",
-        ExportName = "sceKernelMapMemory",
-        Target = Generation.Gen4 | Generation.Gen5,
-        LibraryName = "libKernel")]
-    public static int KernelMapMemory(CpuContext ctx)
-    {
-        ctx[CpuRegister.Rax] = 0;
-        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
-    }
 }

src/SharpEmu.Libs/Kernel/KernelPthreadCompatExports.cs

@@ -61,10 +61,34 @@ public static class KernelPthreadCompatExports
         public string WakeKey { get; } = "pthread_mutex#" + Interlocked.Increment(ref _nextMutexWakeId).ToString("X");
     }
 
-    private sealed class PthreadMutexWaiter
+    private sealed class PthreadMutexWaiter : IGuestThreadBlockWaiter
     {
         public required ulong ThreadId { get; init; }
+        public required CpuContext Ctx { get; init; }
+        public required ulong MutexAddress { get; init; }
+        public required ulong ResolvedAddress { get; init; }
+        public required PthreadMutexState State { get; init; }
         public int Reserved;
+
+        public int Resume() => CompleteBlockedMutexLock(Ctx, MutexAddress, ResolvedAddress, State, this);
+
+        public bool TryWake() => TryReserveBlockedMutexLock(Ctx, MutexAddress, ResolvedAddress, State, this);
+    }
+
+    private sealed class PthreadCondWaiter : IGuestThreadBlockWaiter
+    {
+        public required CpuContext Ctx { get; init; }
+        public required ulong CondAddress { get; init; }
+        public required ulong MutexAddress { get; init; }
+        public required PthreadCondState State { get; init; }
+        public required ulong ObservedEpoch { get; init; }
+        public required bool Timed { get; init; }
+        public required int ReleasedRecursion { get; init; }
+        public required bool PosixResult { get; init; }
+
+        public int Resume() => ResumePthreadCondWait(Ctx, CondAddress, MutexAddress, State, ObservedEpoch, Timed, ReleasedRecursion, PosixResult);
+
+        public bool TryWake() => State.SignalEpoch != ObservedEpoch;
     }
 
     private sealed class PthreadCondState
@@ -629,6 +653,7 @@ public static class KernelPthreadCompatExports
         }
         if (!InitializeMutexObject(ctx, handle, state))
         {
+            TryFreeOpaqueObject(ctx, handle);
             state.Semaphore.Dispose();
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
         }
@@ -641,6 +666,7 @@ public static class KernelPthreadCompatExports
             _mutexStates.TryRemove(mutexAddress, out _);
             _mutexStates.TryRemove(handle, out _);
 
+            TryFreeOpaqueObject(ctx, handle);
             state.Semaphore.Dispose();
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
         }
@@ -668,6 +694,7 @@ public static class KernelPthreadCompatExports
         }
 
         _ = KernelMemoryCompatExports.TryWriteUInt64Compat(ctx, mutexAddress, 0);
+        TryFreeOpaqueObject(ctx, resolvedAddress);
         state.Semaphore.Dispose();
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
@@ -724,7 +751,6 @@ public static class KernelPthreadCompatExports
         if (!acquired)
         {
             TraceContendedMutex(ctx, mutexAddress, resolvedAddress, state, currentThreadId);
-            var waiter = new PthreadMutexWaiter { ThreadId = currentThreadId };
             // Fibers retain the synchronous fallback to preserve switch state.
             var currentFiber = FiberExports.GetCurrentFiberAddressForDiagnostics(ctx);
             var canCooperativelyBlock = _enableMutexLockBlocking || currentFiber == 0;
@@ -736,8 +762,14 @@ public static class KernelPthreadCompatExports
                     ctx,
                     "pthread_mutex_lock",
                     state.WakeKey,
-                    () => CompleteBlockedMutexLock(ctx, mutexAddress, resolvedAddress, state, waiter),
-                    () => TryReserveBlockedMutexLock(ctx, mutexAddress, resolvedAddress, state, waiter)))
+                    new PthreadMutexWaiter
+                    {
+                        ThreadId = currentThreadId,
+                        Ctx = ctx,
+                        MutexAddress = mutexAddress,
+                        ResolvedAddress = resolvedAddress,
+                        State = state,
+                    }))
             {
                 TracePthreadMutex(ctx, "lock-block", mutexAddress, resolvedAddress, state, currentThreadId, (int)OrbisGen2Result.ORBIS_GEN2_OK);
                 return (int)OrbisGen2Result.ORBIS_GEN2_OK;
@@ -895,6 +927,7 @@ public static class KernelPthreadCompatExports
         var initialState = new PthreadMutexAttrState(MutexTypeErrorCheck, 0);
         if (!WriteMutexAttrObject(ctx, handle, initialState))
         {
+            TryFreeOpaqueObject(ctx, handle);
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
         }
 
@@ -912,6 +945,7 @@ public static class KernelPthreadCompatExports
                 _mutexAttrStates.Remove(handle);
             }
 
+            TryFreeOpaqueObject(ctx, handle);
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
         }
 
@@ -935,6 +969,7 @@ public static class KernelPthreadCompatExports
             }
         }
 
+        TryFreeOpaqueObject(ctx, resolvedAddress);
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
@@ -1195,6 +1230,7 @@ public static class KernelPthreadCompatExports
         {
             if (_condStates.TryGetValue(condAddress, out var raced))
             {
+                TryFreeOpaqueObject(ctx, handle);
                 resolvedAddress = condAddress;
                 state = raced;
                 return true;
@@ -1212,6 +1248,7 @@ public static class KernelPthreadCompatExports
                 _condStates.Remove(handle);
             }
 
+            TryFreeOpaqueObject(ctx, handle);
             return false;
         }
 
@@ -1231,7 +1268,22 @@ public static class KernelPthreadCompatExports
 
         Span<byte> initialData = stackalloc byte[size];
         initialData.Clear();
-        return ctx.Memory.TryWrite(address, initialData);
+        if (ctx.Memory.TryWrite(address, initialData))
+        {
+            return true;
+        }
+
+        allocator.TryFreeGuestMemory(address);
+        address = 0;
+        return false;
+    }
+
+    private static void TryFreeOpaqueObject(CpuContext ctx, ulong address)
+    {
+        if (ctx.Memory is IGuestMemoryAllocator allocator)
+        {
+            allocator.TryFreeGuestMemory(address);
+        }
     }
 
     private static bool InitializeMutexObject(CpuContext ctx, ulong address, PthreadMutexState state) =>
@@ -1269,6 +1321,7 @@ public static class KernelPthreadCompatExports
                 _condStates.Remove(handle);
             }
 
+            TryFreeOpaqueObject(ctx, handle);
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
         }
 
@@ -1293,6 +1346,7 @@ public static class KernelPthreadCompatExports
         }
 
         _ = KernelMemoryCompatExports.TryWriteUInt64Compat(ctx, condAddress, 0);
+        TryFreeOpaqueObject(ctx, resolvedAddress);
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
@@ -1363,8 +1417,17 @@ public static class KernelPthreadCompatExports
                     ctx,
                     timed ? "pthread_cond_timedwait" : "pthread_cond_wait",
                     state.WakeKey,
-                    () => ResumePthreadCondWait(ctx, condAddress, mutexAddress, state, observedEpoch, timed, releasedRecursion, posixResult),
-                    () => state.SignalEpoch != observedEpoch,
+                    new PthreadCondWaiter
+                    {
+                        Ctx = ctx,
+                        CondAddress = condAddress,
+                        MutexAddress = mutexAddress,
+                        State = state,
+                        ObservedEpoch = observedEpoch,
+                        Timed = timed,
+                        ReleasedRecursion = releasedRecursion,
+                        PosixResult = posixResult,
+                    },
                     timed ? GuestThreadExecution.ComputeDeadlineTimestamp(GetCondWaitTimeout(timeoutUsec)) : 0))
             {
                 TracePthreadCond(timed ? "wait-block-timed" : "wait-block", condAddress, mutexAddress, state, timed, waitResult);
@@ -1775,6 +1838,7 @@ public static class KernelPthreadCompatExports
         }
         if (!InitializeMutexObject(ctx, handle, createdState))
         {
+            TryFreeOpaqueObject(ctx, handle);
             resolvedAddress = 0;
             state = null;
             return false;
@@ -1784,12 +1848,14 @@ public static class KernelPthreadCompatExports
         {
             if (_mutexStates.TryGetValue(mutexAddress, out state))
             {
+                TryFreeOpaqueObject(ctx, handle);
                 resolvedAddress = mutexAddress;
                 return true;
             }
 
             if (_mutexStates.TryGetValue(handle, out state))
             {
+                TryFreeOpaqueObject(ctx, handle);
                 resolvedAddress = handle;
                 return true;
             }
@@ -1803,6 +1869,7 @@ public static class KernelPthreadCompatExports
             _mutexStates.TryRemove(mutexAddress, out _);
             _mutexStates.TryRemove(handle, out _);
 
+            TryFreeOpaqueObject(ctx, handle);
             resolvedAddress = 0;
             state = null;
             return false;

src/SharpEmu.Libs/Kernel/KernelPthreadExtendedCompatExports.cs

@@ -164,6 +164,17 @@ public static class KernelPthreadExtendedCompatExports
         }
     }
 
+    private sealed class RwlockWaiter : IGuestThreadBlockWaiter
+    {
+        public required PthreadRwlockState Rwlock { get; init; }
+        public required ulong ThreadId { get; init; }
+        public required bool Write { get; init; }
+
+        public int Resume() => (int)OrbisGen2Result.ORBIS_GEN2_OK;
+
+        public bool TryWake() => TryAcquireBlockedRwlock(Rwlock, ThreadId, Write);
+    }
+
     private readonly record struct TlsKeyState(ulong Destructor);
 
     private readonly record struct PthreadAttrState(
@@ -382,6 +393,47 @@ public static class KernelPthreadExtendedCompatExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "oIRFTjoILbg",
+        ExportName = "scePthreadSetschedparam",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PthreadSetschedparam(CpuContext ctx) => PosixPthreadSetschedparam(ctx);
+
+    [SysAbiExport(
+        Nid = "P41kTWUS3EI",
+        ExportName = "scePthreadGetschedparam",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PthreadGetschedparam(CpuContext ctx)
+    {
+        var thread = ctx[CpuRegister.Rdi];
+        var outPolicyAddress = ctx[CpuRegister.Rsi];
+        var outSchedParamAddress = ctx[CpuRegister.Rdx];
+        if (thread == 0 || outPolicyAddress == 0 || outSchedParamAddress == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        int policy;
+        int priority;
+        lock (_stateGate)
+        {
+            var state = GetOrCreateThreadStateLocked(thread);
+            policy = state.Attributes.SchedPolicy;
+            priority = state.Priority;
+        }
+
+        if (!ctx.TryWriteInt32(outPolicyAddress, policy) ||
+            !ctx.TryWriteInt32(outSchedParamAddress, priority))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
     [SysAbiExport(
         Nid = "nsYoNRywwNg",
         ExportName = "scePthreadAttrInit",
@@ -1318,8 +1370,7 @@ public static class KernelPthreadExtendedCompatExports
                             ctx,
                             "pthread_rwlock_wrlock",
                             rwlock.WakeKey,
-                            static () => (int)OrbisGen2Result.ORBIS_GEN2_OK,
-                            () => TryAcquireBlockedRwlock(rwlock, currentThreadId, write: true)))
+                            new RwlockWaiter { Rwlock = rwlock, ThreadId = currentThreadId, Write = true }))
                     {
                         transferredToScheduler = true;
                         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
@@ -1355,8 +1406,7 @@ public static class KernelPthreadExtendedCompatExports
                             ctx,
                             "pthread_rwlock_rdlock",
                             rwlock.WakeKey,
-                            static () => (int)OrbisGen2Result.ORBIS_GEN2_OK,
-                            () => TryAcquireBlockedRwlock(rwlock, currentThreadId, write: false)))
+                            new RwlockWaiter { Rwlock = rwlock, ThreadId = currentThreadId, Write = false }))
                     {
                         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
                     }

src/SharpEmu.Libs/Kernel/KernelRuntimeCompatExports.cs

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 using SharpEmu.HLE;
+using SharpEmu.HLE.Host;
 using SharpEmu.Libs.Fiber;
 using System.Buffers.Binary;
 using System.Diagnostics;
@@ -48,9 +49,6 @@ public static class KernelRuntimeCompatExports
     private const int MapFlagFixed = 0x10;
     private const ulong DefaultVirtualRangeAlignment = 0x4000UL;
     private const int AioInitParamSize = 0x3C;
-    private const uint MemCommit = 0x1000;
-    private const uint MemReserve = 0x2000;
-    private const uint PageExecuteReadWrite = 0x40;
     private static readonly object _stateGate = new();
     private static readonly long _processStartCounter = Stopwatch.GetTimestamp();
     private static readonly RdtscDelegate? _rdtscReader = CreateRdtscReader();
@@ -1893,7 +1891,7 @@ public static class KernelRuntimeCompatExports
 
         try
         {
-            nint stubAddress = VirtualAlloc(nint.Zero, (nuint)16, MemCommit | MemReserve, PageExecuteReadWrite);
+            nint stubAddress = unchecked((nint)HostPlatform.Current.Memory.Allocate(0, 16, HostPageProtection.ReadWriteExecute));
             if (stubAddress == 0)
             {
                 return null;
@@ -1923,9 +1921,6 @@ public static class KernelRuntimeCompatExports
         }
     }
 
-    [DllImport("kernel32.dll", SetLastError = true)]
-    private static extern nint VirtualAlloc(nint lpAddress, nuint dwSize, uint flAllocationType, uint flProtect);
-
     private static bool TryReserveVirtualRange(
         CpuContext ctx,
         ulong desiredAddress,

src/SharpEmu.Libs/Kernel/KernelSemaphoreCompatExports.cs

@@ -19,6 +19,8 @@ public static class KernelSemaphoreCompatExports
     private sealed class KernelSemaphoreState
     {
         public required string Name { get; init; }
+        // Formatted once at creation; signal/wait/cancel/delete all wake through this key.
+        public required string WakeKey { get; init; }
         public required int InitialCount { get; init; }
         public required int MaxCount { get; init; }
         public int Count { get; set; }
@@ -28,14 +30,26 @@ public static class KernelSemaphoreCompatExports
         public object Gate { get; } = new();
     }
 
-    private sealed class SemaphoreWaiter
+    private sealed class SemaphoreWaiter : IGuestThreadBlockWaiter
     {
+        public required KernelSemaphoreState Semaphore { get; init; }
         public required int NeedCount { get; init; }
         public required int CancelEpochAtBlock { get; init; }
         public bool Timed { get; init; }
 
+        // Timed-wait completion state; unused when Timed is false.
+        public CpuContext? Ctx { get; init; }
+        public ulong TimeoutAddress { get; init; }
+        public long DeadlineTimestamp { get; init; }
+
         // Written and read only under the owning semaphore's Gate.
         public int? Result { get; set; }
+
+        public int Resume() => Timed
+            ? CompleteBlockedTimedSemaWait(Ctx!, Semaphore, this, TimeoutAddress, DeadlineTimestamp)
+            : CompleteBlockedSemaWait(Semaphore, this);
+
+        public bool TryWake() => TryConsumeBlockedSemaWait(Semaphore, this);
     }
 
     private static string GetSemaphoreWakeKey(uint handle) => $"kernel_sema:0x{handle:X8}";
@@ -79,6 +93,7 @@ public static class KernelSemaphoreCompatExports
         var state = new KernelSemaphoreState
         {
             Name = name,
+            WakeKey = GetSemaphoreWakeKey(handle),
             InitialCount = initialCount,
             MaxCount = maxCount,
             Count = initialCount,
@@ -96,11 +111,14 @@ public static class KernelSemaphoreCompatExports
                 state.Deleted = true;
             }
 
-            _ = GuestThreadExecution.Scheduler?.WakeBlockedThreads(GetSemaphoreWakeKey(handle));
+            _ = GuestThreadExecution.Scheduler?.WakeBlockedThreads(state.WakeKey);
             return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
         }
 
-        TraceSemaphore($"create handle=0x{handle:X8} name='{name}' attr=0x{attr:X} init={initialCount} max={maxCount}");
+        if (_traceSema)
+        {
+            TraceSemaphore($"create handle=0x{handle:X8} name='{name}' attr=0x{attr:X} init={initialCount} max={maxCount}");
+        }
         return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_OK);
     }
 
@@ -131,7 +149,10 @@ public static class KernelSemaphoreCompatExports
             if (semaphore.Count >= needCount)
             {
                 semaphore.Count -= needCount;
-                TraceSemaphore($"wait handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count}");
+                if (_traceSema)
+                {
+                    TraceSemaphore($"wait handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count}");
+                }
                 return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_OK);
             }
 
@@ -145,7 +166,10 @@ public static class KernelSemaphoreCompatExports
                 if (timeoutMicros == 0)
                 {
                     _ = ctx.TryWriteUInt32(timeoutAddress, 0);
-                    TraceSemaphore($"wait-timeout handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count}");
+                    if (_traceSema)
+                    {
+                        TraceSemaphore($"wait-timeout handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count}");
+                    }
                     pollTimedOut = true;
                 }
                 else
@@ -153,27 +177,36 @@ public static class KernelSemaphoreCompatExports
                     var deadline = GuestThreadExecution.ComputeDeadlineTimestamp(TimeSpan.FromTicks((long)timeoutMicros * 10L));
                     var timedWaiter = new SemaphoreWaiter
                     {
+                        Semaphore = semaphore,
                         NeedCount = needCount,
                         CancelEpochAtBlock = semaphore.CancelEpoch,
                         Timed = true,
+                        Ctx = ctx,
+                        TimeoutAddress = timeoutAddress,
+                        DeadlineTimestamp = deadline,
                     };
                     if (GuestThreadExecution.RequestCurrentThreadBlock(
                             ctx,
                             "sceKernelWaitSema",
-                            GetSemaphoreWakeKey(handle),
-                            resumeHandler: () => CompleteBlockedTimedSemaWait(ctx, semaphore, timedWaiter, timeoutAddress, deadline),
-                            wakeHandler: () => TryConsumeBlockedSemaWait(semaphore, timedWaiter),
+                            semaphore.WakeKey,
+                            timedWaiter,
                             blockDeadlineTimestamp: deadline))
                     {
                         semaphore.WaitingThreads++;
-                        TraceSemaphore($"wait-block-timed handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count} timeout_us={timeoutMicros} waiters={semaphore.WaitingThreads}");
+                        if (_traceSema)
+                        {
+                            TraceSemaphore($"wait-block-timed handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count} timeout_us={timeoutMicros} waiters={semaphore.WaitingThreads}");
+                        }
                         return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_OK);
                     }
 
                     // Host-owned threads cannot park in the guest scheduler; degrade to the
                     // immediate-timeout poll the callers already tolerate.
                     _ = ctx.TryWriteUInt32(timeoutAddress, 0);
-                    TraceSemaphore($"wait-timeout handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count}");
+                    if (_traceSema)
+                    {
+                        TraceSemaphore($"wait-timeout handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count}");
+                    }
                     pollTimedOut = true;
                 }
             }
@@ -182,22 +215,28 @@ public static class KernelSemaphoreCompatExports
             {
                 var waiter = new SemaphoreWaiter
                 {
+                    Semaphore = semaphore,
                     NeedCount = needCount,
                     CancelEpochAtBlock = semaphore.CancelEpoch,
                 };
                 if (!GuestThreadExecution.RequestCurrentThreadBlock(
                         ctx,
                         "sceKernelWaitSema",
-                        GetSemaphoreWakeKey(handle),
-                        resumeHandler: () => CompleteBlockedSemaWait(semaphore, waiter),
-                        wakeHandler: () => TryConsumeBlockedSemaWait(semaphore, waiter)))
+                        semaphore.WakeKey,
+                        waiter))
                 {
-                    TraceSemaphore($"wait-would-block handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count}");
+                    if (_traceSema)
+                    {
+                        TraceSemaphore($"wait-would-block handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count}");
+                    }
                     return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_TRY_AGAIN);
                 }
 
                 semaphore.WaitingThreads++;
-                TraceSemaphore($"wait-block handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count} waiters={semaphore.WaitingThreads}");
+                if (_traceSema)
+                {
+                    TraceSemaphore($"wait-block handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count} waiters={semaphore.WaitingThreads}");
+                }
                 return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_OK);
             }
         }
@@ -239,12 +278,18 @@ public static class KernelSemaphoreCompatExports
         {
             if (semaphore.Count < needCount)
             {
-                TraceSemaphore($"poll-busy handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count}");
+                if (_traceSema)
+                {
+                    TraceSemaphore($"poll-busy handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count}");
+                }
                 return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_BUSY);
             }
 
             semaphore.Count -= needCount;
-            TraceSemaphore($"poll handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count}");
+            if (_traceSema)
+            {
+                TraceSemaphore($"poll handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count}");
+            }
             return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_OK);
         }
     }
@@ -277,14 +322,17 @@ public static class KernelSemaphoreCompatExports
             }
 
             semaphore.Count += signalCount;
-            TraceSemaphore($"signal handle=0x{handle:X8} name='{semaphore.Name}' signal={signalCount} count={semaphore.Count} waiters={semaphore.WaitingThreads}");
+            if (_traceSema)
+            {
+                TraceSemaphore($"signal handle=0x{handle:X8} name='{semaphore.Name}' signal={signalCount} count={semaphore.Count} waiters={semaphore.WaitingThreads}");
+            }
         }
 
         // Wake after releasing the gate (lock order: scheduler gate -> semaphore gate).
         // Wake everyone; the wake handler consumes the count per waiter, so a waiter
         // whose needCount exceeds the remaining count stays parked while a smaller
         // waiter can proceed.
-        _ = GuestThreadExecution.Scheduler?.WakeBlockedThreads(GetSemaphoreWakeKey(handle));
+        _ = GuestThreadExecution.Scheduler?.WakeBlockedThreads(semaphore.WakeKey);
         return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_OK);
     }
 
@@ -322,10 +370,13 @@ public static class KernelSemaphoreCompatExports
             // exactly once in its wake handler. Zeroing here as well would double-count
             // and silently absorb the increment of a waiter that parks between this
             // gate release and the wake-all below.
-            TraceSemaphore($"cancel handle=0x{handle:X8} name='{semaphore.Name}' set={setCount} count={semaphore.Count}");
+            if (_traceSema)
+            {
+                TraceSemaphore($"cancel handle=0x{handle:X8} name='{semaphore.Name}' set={setCount} count={semaphore.Count}");
+            }
         }
 
-        _ = GuestThreadExecution.Scheduler?.WakeBlockedThreads(GetSemaphoreWakeKey(handle));
+        _ = GuestThreadExecution.Scheduler?.WakeBlockedThreads(semaphore.WakeKey);
         return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_OK);
     }
 
@@ -349,8 +400,11 @@ public static class KernelSemaphoreCompatExports
             semaphore.Deleted = true;
         }
 
-        _ = GuestThreadExecution.Scheduler?.WakeBlockedThreads(GetSemaphoreWakeKey(handle));
-        TraceSemaphore($"delete handle=0x{handle:X8} name='{semaphore.Name}'");
+        _ = GuestThreadExecution.Scheduler?.WakeBlockedThreads(semaphore.WakeKey);
+        if (_traceSema)
+        {
+            TraceSemaphore($"delete handle=0x{handle:X8} name='{semaphore.Name}'");
+        }
         return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_OK);
     }
 
@@ -376,7 +430,10 @@ public static class KernelSemaphoreCompatExports
         {
             waiter.Result = (int)OrbisGen2Result.ORBIS_GEN2_ERROR_DELETED;
             semaphore.WaitingThreads = Math.Max(0, semaphore.WaitingThreads - 1);
-            TraceSemaphore($"wake-deleted name='{semaphore.Name}' need={waiter.NeedCount}");
+            if (_traceSema)
+            {
+                TraceSemaphore($"wake-deleted name='{semaphore.Name}' need={waiter.NeedCount}");
+            }
             return true;
         }
 
@@ -384,7 +441,10 @@ public static class KernelSemaphoreCompatExports
         {
             waiter.Result = (int)OrbisGen2Result.ORBIS_GEN2_ERROR_CANCELED;
             semaphore.WaitingThreads = Math.Max(0, semaphore.WaitingThreads - 1);
-            TraceSemaphore($"wake-canceled name='{semaphore.Name}' need={waiter.NeedCount}");
+            if (_traceSema)
+            {
+                TraceSemaphore($"wake-canceled name='{semaphore.Name}' need={waiter.NeedCount}");
+            }
             return true;
         }
 
@@ -393,7 +453,10 @@ public static class KernelSemaphoreCompatExports
             semaphore.Count -= waiter.NeedCount;
             waiter.Result = (int)OrbisGen2Result.ORBIS_GEN2_OK;
             semaphore.WaitingThreads = Math.Max(0, semaphore.WaitingThreads - 1);
-            TraceSemaphore($"wake-consume name='{semaphore.Name}' need={waiter.NeedCount} count={semaphore.Count} waiters={semaphore.WaitingThreads}");
+            if (_traceSema)
+            {
+                TraceSemaphore($"wake-consume name='{semaphore.Name}' need={waiter.NeedCount} count={semaphore.Count} waiters={semaphore.WaitingThreads}");
+            }
             return true;
         }
 
@@ -434,7 +497,10 @@ public static class KernelSemaphoreCompatExports
             {
                 waiter.Result = (int)OrbisGen2Result.ORBIS_GEN2_ERROR_TIMED_OUT;
                 semaphore.WaitingThreads = Math.Max(0, semaphore.WaitingThreads - 1);
-                TraceSemaphore($"wake-timeout name='{semaphore.Name}' need={waiter.NeedCount} count={semaphore.Count} waiters={semaphore.WaitingThreads}");
+                if (_traceSema)
+                {
+                    TraceSemaphore($"wake-timeout name='{semaphore.Name}' need={waiter.NeedCount} count={semaphore.Count} waiters={semaphore.WaitingThreads}");
+                }
             }
 
             result = waiter.Result!.Value;
@@ -456,11 +522,13 @@ public static class KernelSemaphoreCompatExports
         return result;
     }
 
+    // Call sites must check this before building the interpolated message; the trace
+    // strings would otherwise be allocated on every semaphore op even with tracing off.
+    private static readonly bool _traceSema =
+        string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_SEMA"), "1", StringComparison.Ordinal);
+
     private static void TraceSemaphore(string message)
     {
-        if (string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_SEMA"), "1", StringComparison.Ordinal))
-        {
-            Console.Error.WriteLine($"[LOADER][TRACE] sema.{message}");
-        }
+        Console.Error.WriteLine($"[LOADER][TRACE] sema.{message}");
     }
 }

src/SharpEmu.Libs/Kernel/KernelVirtualRangeAllocator.cs

@@ -3,15 +3,12 @@
 
 using SharpEmu.HLE;
 using System;
-using System.Collections.Concurrent;
-using System.Reflection;
+using System.Diagnostics.CodeAnalysis;
 
 namespace SharpEmu.Libs.Kernel;
 
 internal static class KernelVirtualRangeAllocator
 {
-    private static readonly ConcurrentDictionary<Type, Accessor> _accessors = new();
-
     public static bool TryReserve(
         CpuContext ctx,
         ulong desiredAddress,
@@ -31,38 +28,24 @@ internal static class KernelVirtualRangeAllocator
 
         try
         {
-            if (!TryResolveAccessor(ctx.Memory, out var target, out var accessor))
+            if (!TryResolveAddressSpace(ctx.Memory, out var addressSpace))
             {
                 Console.Error.WriteLine($"[LOADER][TRACE] {traceName}: AllocateAt missing on {ctx.Memory.GetType().FullName}");
                 return false;
             }
 
-            if (allowSearch && accessor.AllocateAtOrAbove is not null)
+            if (allowSearch &&
+                addressSpace.TryAllocateAtOrAbove(desiredAddress, length, executable, alignment, out var searchedAddress) &&
+                searchedAddress != 0)
             {
-                var searchArgs = new object[] { desiredAddress, length, executable, alignment, 0UL };
-                var searchResult = accessor.AllocateAtOrAbove.Invoke(target, searchArgs);
-                if (searchResult is bool trueValue && trueValue &&
-                    searchArgs[4] is ulong searchedAddress && searchedAddress != 0)
-                {
-                    mappedAddress = searchedAddress;
-                    return true;
-                }
+                mappedAddress = searchedAddress;
+                return true;
             }
 
-            if (accessor.AllocateAt is null)
+            var allocated = addressSpace.AllocateAt(desiredAddress, length, executable, allowAllocateAtAlternative);
+            if (allocated == 0)
             {
-                Console.Error.WriteLine($"[LOADER][TRACE] {traceName}: AllocateAt missing on {target.GetType().FullName}");
-                return false;
-            }
-
-            var invokeArgs = accessor.AllocateAtHasAllowAlternativeArg
-                ? new object[] { desiredAddress, length, executable, allowAllocateAtAlternative }
-                : new object[] { desiredAddress, length, executable };
-            var result = accessor.AllocateAt.Invoke(target, invokeArgs);
-            if (result is not ulong allocated || allocated == 0)
-            {
-                var resultType = result?.GetType().FullName ?? "null";
-                Console.Error.WriteLine($"[LOADER][TRACE] {traceName}: AllocateAt returned {resultType} value={result ?? "null"}");
+                Console.Error.WriteLine($"[LOADER][TRACE] {traceName}: AllocateAt returned {typeof(ulong).FullName} value=0");
                 return false;
             }
 
@@ -76,84 +59,36 @@ internal static class KernelVirtualRangeAllocator
         }
     }
 
-    private static bool TryResolveAccessor(object rootMemory, out object target, out Accessor accessor)
+    /// <summary>
+    /// Finds the <see cref="IGuestAddressSpace"/> behind <paramref name="rootMemory"/>,
+    /// unwrapping decorators (bounded, like the reflection walker this replaced).
+    /// </summary>
+    public static bool TryResolveAddressSpace(ICpuMemory rootMemory, [NotNullWhen(true)] out IGuestAddressSpace? addressSpace)
     {
-        target = rootMemory;
-        accessor = default;
-
+        var target = rootMemory;
         for (var depth = 0; depth < 4; depth++)
         {
-            accessor = _accessors.GetOrAdd(target.GetType(), DiscoverAccessor);
-            if (accessor.AllocateAt is not null || accessor.AllocateAtOrAbove is not null)
+            if (target is IGuestAddressSpace resolved)
             {
+                addressSpace = resolved;
                 return true;
             }
 
-            if (accessor.InnerProperty is null)
+            if (target is not ICpuMemoryWrapper wrapper)
             {
                 break;
             }
 
-            var innerValue = accessor.InnerProperty.GetValue(target);
-            if (innerValue is null || ReferenceEquals(innerValue, target))
+            var inner = wrapper.Inner;
+            if (inner is null || ReferenceEquals(inner, target))
             {
                 break;
             }
 
-            target = innerValue;
+            target = inner;
         }
 
+        addressSpace = null;
         return false;
     }
-
-    private static Accessor DiscoverAccessor(Type type)
-    {
-        MethodInfo? allocateAt = null;
-        MethodInfo? allocateAtOrAbove = null;
-        var allocateAtHasAllowAlternativeArg = false;
-
-        foreach (var candidate in type.GetMethods(BindingFlags.Public | BindingFlags.Instance))
-        {
-            var parameters = candidate.GetParameters();
-            if (string.Equals(candidate.Name, "TryAllocateAtOrAbove", StringComparison.Ordinal) &&
-                parameters.Length == 5 &&
-                parameters[0].ParameterType == typeof(ulong) &&
-                parameters[1].ParameterType == typeof(ulong) &&
-                parameters[2].ParameterType == typeof(bool) &&
-                parameters[3].ParameterType == typeof(ulong) &&
-                parameters[4].ParameterType == typeof(ulong).MakeByRefType())
-            {
-                allocateAtOrAbove = candidate;
-            }
-            else if (string.Equals(candidate.Name, "AllocateAt", StringComparison.Ordinal))
-            {
-                if (parameters.Length == 3 &&
-                    parameters[0].ParameterType == typeof(ulong) &&
-                    parameters[1].ParameterType == typeof(ulong) &&
-                    parameters[2].ParameterType == typeof(bool))
-                {
-                    allocateAt = candidate;
-                    allocateAtHasAllowAlternativeArg = false;
-                }
-                else if (parameters.Length == 4 &&
-                    parameters[0].ParameterType == typeof(ulong) &&
-                    parameters[1].ParameterType == typeof(ulong) &&
-                    parameters[2].ParameterType == typeof(bool) &&
-                    parameters[3].ParameterType == typeof(bool))
-                {
-                    allocateAt = candidate;
-                    allocateAtHasAllowAlternativeArg = true;
-                }
-            }
-        }
-
-        var innerProperty = type.GetProperty("Inner", BindingFlags.Public | BindingFlags.Instance);
-        return new Accessor(allocateAt, allocateAtOrAbove, allocateAtHasAllowAlternativeArg, innerProperty);
-    }
-
-    private readonly record struct Accessor(
-        MethodInfo? AllocateAt,
-        MethodInfo? AllocateAtOrAbove,
-        bool AllocateAtHasAllowAlternativeArg,
-        PropertyInfo? InnerProperty);
 }

src/SharpEmu.Libs/Mouse/MouseExports.cs

@@ -7,6 +7,17 @@ namespace SharpEmu.Libs.Mouse;
 
 public static class MouseExports
 {
+    [SysAbiExport(
+        Nid = "Qs0wWulgl7U",
+        ExportName = "sceMouseInit",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceMouse")]
+    public static int MouseInit(CpuContext ctx)
+    {
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
     // Returns 0 read entries: no mouse is connected. This NID was previously misbound
     // as an sceNgs2VoiceGetState alias.
     [SysAbiExport(

src/SharpEmu.Libs/Network/NetCtlExports.cs

@@ -146,6 +146,13 @@ public static class NetCtlExports
         return ctx.SetReturn((int)OrbisGen2Result.ORBIS_GEN2_OK, typeof(long));
     }
 
+    [SysAbiExport(
+        Nid = "1NE9OWdBIww",
+        ExportName = "sceNetCtlRegisterCallbackV6",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNetCtl")]
+    public static int NetCtlRegisterCallbackV6(CpuContext ctx) => NetCtlRegisterCallback(ctx);
+
     [SysAbiExport(
         Nid = "obuxdTiwkF8",
         ExportName = "sceNetCtlGetInfo",

src/SharpEmu.Libs/Ngs2/Ngs2Exports.cs

@@ -237,6 +237,27 @@ public static class Ngs2Exports
         LibraryName = "libSceNgs2")]
     public static int Ngs2PanInit(CpuContext ctx) => ctx.SetReturn(0);
 
+    [SysAbiExport(
+        Nid = "1WsleK-MTkE",
+        ExportName = "sceNgs2GeomCalcListener",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNgs2")]
+    public static int Ngs2GeomCalcListener(CpuContext ctx) => ctx.SetReturn(0);
+
+    [SysAbiExport(
+        Nid = "0lbbayqDNoE",
+        ExportName = "sceNgs2GeomResetSourceParam",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNgs2")]
+    public static int Ngs2GeomResetSourceParam(CpuContext ctx) => ctx.SetReturn(0);
+
+    [SysAbiExport(
+        Nid = "7Lcfo8SmpsU",
+        ExportName = "sceNgs2GeomResetListenerParam",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNgs2")]
+    public static int Ngs2GeomResetListenerParam(CpuContext ctx) => ctx.SetReturn(0);
+
     [SysAbiExport(
         Nid = "i0VnXM-C9fc",
         ExportName = "sceNgs2SystemRender",

src/SharpEmu.Libs/Np/NpCppWebApiExports.cs

@@ -0,0 +1,34 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.Np;
+
+// Stub for sce::Np::CppWebApi: titles abort PS5-component startup if
+// Common::initialize returns a negative SCE error, so no-op success is required to boot.
+public static class NpCppWebApiExports
+{
+    [SysAbiExport(
+        Nid = "UYPxv8MIzGo",
+        ExportName = "_ZN3sce2Np9CppWebApi6Common10initializeERKNS2_10InitParamsERNS2_10LibContextE",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNpCppWebApi")]
+    public static int CppWebApiCommonInitialize(CpuContext ctx)
+    {
+        // int Common::initialize(const InitParams&, LibContext&) — 0 on success.
+        TraceCppWebApi("common_initialize", ctx[CpuRegister.Rdi], ctx[CpuRegister.Rsi]);
+        return ctx.SetReturn(0);
+    }
+
+    private static void TraceCppWebApi(string operation, ulong arg0, ulong arg1)
+    {
+        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_NP"), "1", StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine(
+            $"[LOADER][TRACE] np_cppwebapi.{operation} arg0=0x{arg0:X16} arg1=0x{arg1:X16}");
+    }
+}

src/SharpEmu.Libs/Np/NpManagerExports.cs

@@ -59,7 +59,7 @@ public static class NpManagerExports
 
     [SysAbiExport(
         Nid = "rbknaUjpqWo",
-        ExportName = "sceNpGetOnlineIdA",
+        ExportName = "sceNpGetAccountIdA",
         Target = Generation.Gen5,
         LibraryName = "libSceNpManager")]
     public static int NpGetOnlineIdA(CpuContext ctx)

src/SharpEmu.Libs/Np/NpUniversalDataSystemExports.cs

@@ -9,7 +9,10 @@ namespace SharpEmu.Libs.Np;
 public static class NpUniversalDataSystemExports
 {
     private const int NpUniversalDataSystemErrorInvalidArgument = unchecked((int)0x80553102);
+    private static readonly object _eventGate = new();
+    private static readonly HashSet<int> _createdEvents = [];
     private static int _nextHandle = 1;
+    private static int _nextEvent = 1;
 
     [SysAbiExport(
         Nid = "sjaobBgqeB4",
@@ -67,6 +70,114 @@ public static class NpUniversalDataSystemExports
         return ctx.SetReturn((int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT, typeof(long));
     }
 
+    [SysAbiExport(
+        Nid = "p+GcLqwpL9M",
+        ExportName = "sceNpUniversalDataSystemCreateEvent",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNpUniversalDataSystem")]
+    public static int NpUniversalDataSystemCreateEvent(CpuContext ctx)
+    {
+        var parameterAddress = ctx[CpuRegister.Rdi];
+        if (parameterAddress == 0)
+        {
+            return ctx.SetReturn(NpUniversalDataSystemErrorInvalidArgument, typeof(long));
+        }
+
+        var eventId = Interlocked.Increment(ref _nextEvent);
+        lock (_eventGate)
+        {
+            _createdEvents.Add(eventId);
+        }
+
+        if (ctx.TryWriteInt32(ctx[CpuRegister.Rdx], eventId, checkNil: true) ||
+            ctx.TryWriteInt32(ctx[CpuRegister.Rcx], eventId, checkNil: true))
+        {
+            return ctx.SetReturn(0, typeof(long));
+        }
+
+        lock (_eventGate)
+        {
+            _createdEvents.Remove(eventId);
+        }
+
+        return ctx.SetReturn((int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT, typeof(long));
+    }
+
+    [SysAbiExport(
+        Nid = "wG+84pnNIuo",
+        ExportName = "sceNpUniversalDataSystemDestroyEvent",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNpUniversalDataSystem")]
+    public static int NpUniversalDataSystemDestroyEvent(CpuContext ctx)
+    {
+        var eventId = unchecked((int)ctx[CpuRegister.Rdi]);
+        lock (_eventGate)
+        {
+            _createdEvents.Remove(eventId);
+        }
+
+        return ctx.SetReturn(0, typeof(long));
+    }
+
+    [SysAbiExport(
+        Nid = "MfDb+4Nln64",
+        ExportName = "sceNpUniversalDataSystemEventPropertyObjectSetString",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNpUniversalDataSystem")]
+    public static int NpUniversalDataSystemEventPropertyObjectSetString(CpuContext ctx)
+    {
+        var propertyObjectAddress = ctx[CpuRegister.Rsi];
+        var valueAddress = ctx[CpuRegister.Rdx];
+        if (propertyObjectAddress == 0 || valueAddress == 0)
+        {
+            return ctx.SetReturn(NpUniversalDataSystemErrorInvalidArgument, typeof(long));
+        }
+
+        Span<byte> probe = stackalloc byte[1];
+        return ctx.Memory.TryRead(propertyObjectAddress, probe) &&
+               ctx.Memory.TryRead(valueAddress, probe)
+            ? ctx.SetReturn(0, typeof(long))
+            : ctx.SetReturn((int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT, typeof(long));
+    }
+
+    [SysAbiExport(
+        Nid = "Wxbg5x3pTXA",
+        ExportName = "sceNpUniversalDataSystemEventPropertyObjectSetArray",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNpUniversalDataSystem")]
+    public static int NpUniversalDataSystemEventPropertyObjectSetArray(CpuContext ctx)
+    {
+        var propertyObjectAddress = ctx[CpuRegister.Rsi];
+        var valueAddress = ctx[CpuRegister.Rdx];
+        if (propertyObjectAddress == 0)
+        {
+            return ctx.SetReturn(NpUniversalDataSystemErrorInvalidArgument, typeof(long));
+        }
+
+        Span<byte> probe = stackalloc byte[1];
+        if (!ctx.Memory.TryRead(propertyObjectAddress, probe))
+        {
+            return ctx.SetReturn((int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT, typeof(long));
+        }
+
+        if (valueAddress != 0 && !ctx.Memory.TryRead(valueAddress, probe))
+        {
+            return ctx.SetReturn((int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT, typeof(long));
+        }
+
+        return ctx.SetReturn(0, typeof(long));
+    }
+
+    [SysAbiExport(
+        Nid = "CzkKf7ahIyU",
+        ExportName = "sceNpUniversalDataSystemPostEvent",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNpUniversalDataSystem")]
+    public static int NpUniversalDataSystemPostEvent(CpuContext ctx)
+    {
+        return ctx.SetReturn(0, typeof(long));
+    }
+
     [SysAbiExport(
         Nid = "tpFJ8LIKvPw",
         ExportName = "sceNpUniversalDataSystemRegisterContext",

src/SharpEmu.Libs/Np/NpWebApi2Exports.cs

@@ -33,7 +33,7 @@ public static class NpWebApi2Exports
 
     [SysAbiExport(
         Nid = "WV1GwM32NgY",
-        ExportName = "sceNpWebApi2InitializeForToolkit",
+        ExportName = "sceNpWebApi2PushEventCreateHandle",
         Target = Generation.Gen4 | Generation.Gen5,
         LibraryName = "libSceNpWebApi2")]
     public static int NpWebApi2InitializeAlt(CpuContext ctx)