| name | psx-rizin |
| description | Evidence-driven PlayStation 1 reverse-engineering with Rizin, runtime traces, symbols, overlays, and matching decompilation. Use only when the user explicitly invokes `$psx-rizin` or asks to load this skill. |
| license | MIT |
| compatibility | Linux, macOS, or WSL; Python 3.10+; Rizin recommended; optional rz-ghidra and emulator/decompilation tools. |
| metadata | {"author":"OpenAI","version":"1.0.0","invocation":"$psx-rizin","platform":"Sony PlayStation / PS1 / PSX"} |
PSX Rizin
Explicit invocation only. Findings reproducible from authorized machine code + runtime evidence. Analyzer/decompiler/signature output = hypothesis until corroborated.
Rules
- Never redistribute proprietary game/BIOS/SDK payloads.
- Record input hashes, revisions, tool versions, extraction provenance.
- Qualify every address: file offset + runtime address + overlay/module.
- Validate PS-X EXE load addresses and cached/uncached RAM aliases.
- Inspect MIPS branch/call/load delay slots before inferring behavior.
- Analyze mixed code/data in bounded stages; never unrestricted global analysis.
- Validate functions/args/types/names across callers, instructions, runtime evidence where practical.
- Keep independently loaded overlays in separate namespaces.
- Record symbol/signature provenance + confidence; preserve source names.
- Repo workspace: snapshots
out/reverse/snapshots/<encoded-target>.json (bin/rz-project), index out/index/ (bin/rev-query), matching
out/matching/, out/permuter/, out/asm-diff/. Prefer wired bin/ entrypoints that cover the task.
Snapshot readiness
Read-only summary before analysis/index work (one target or all):
python3 .pi/skills/psx-rizin/scripts/snapshot-status.py [TARGET]
Emits manifest identity, binary hash, snapshot freshness, index readiness as one JSON; never runs analysis or changes files. Stale: bin/rz-project analyze TARGET, then bin/index.
Route the task
| Call | Action |
|---|
$psx-rizin inventory <disc-or-directory> | disc inventory |
$psx-rizin inspect-exe <PS-X-EXE> | EXE parse |
$psx-rizin analyze <binary> [base-address] | static analysis |
$psx-rizin analyze-overlays <directory> | overlay analysis |
$psx-rizin function <binary> <runtime-address> [base-address] | function + callers |
$psx-rizin symbols <symbol-source> | symbol import |
$psx-rizin trace <replay-or-scenario> | runtime trace |
$psx-rizin replay-coverage <replay-directory> | replay coverage |
$psx-rizin build-diff [function-or-target] | matching diff |
$psx-rizin audit <case-directory> | case audit |
Free-form requests valid; state assumptions; don't block on minor syntax ambiguity.
Read progressively
Broad case: read WORKFLOW.md. Focused task: matching reference only, then bundled script help.
Deliver
Report needed evidence only: input identity + proven address model; target/overlay-qualified findings + confidence; relevant static + runtime evidence; matching status when requested; contradictions/unknowns/next experiment. Mark unsupported conclusions [INFERRED] with the evidence chain.
Broad-case completion verifies: inventory, address mapping, overlay identity, function boundaries, indirect control flow, symbol provenance, runtime coverage, decompiler reconciliation, exclusion of proprietary inputs from distributable artifacts.
Utilities
Repo-wired: bin/rz-project — target-qualified analyze/status/open (writes out/reverse/snapshots/<encoded-target>.json); bin/rev-query — cross-target index (out/index/). Lift-side (asm-diff/byte-match/permute/decomp-status/symbols/splat) follow the bof3-re evidence table.
Note: legacy bin/psx-rizin, bin/lift, bin/build-diff, and generic scripts/*.py helpers are NOT wired here. scripts/snapshot-status.py is the supported read-only readiness check above; use bin/ entrypoints for analysis, symbol import, replay coverage.
