Client-preservation project · real 2013 retail build · Wine on Linux

SUPER STAR LIVE

Booting the original client with no servers, no launcher and no anti-cheat — and publishing exactly where it stands.

It boots and renders It crashes intermittently It is not playable yet
41boot runs recorded3,545,844 bytes of Wine trace
18died with a page fault4 distinct fault addresses
2died inside Wine itself1 exception · 1 glibc abort
21runs with no crash line13 of them never got past start-up
13frames capturedeach cropped to the client's own 1024×720 window
2.98 GBoffline client on diskretail tree 2.85 GB

Where it actually stands

This page is generated from the project's own artifacts — 41 Wine trace logs, 13 captured frames and a diffed client tree. Where something is not yet true, it says so.

Verified working

  • The client boots under Wine and draws its own 3D — the CHOROCK GAMES splash, a lit pre-login room with a working account form, and full venue interiors.
  • All nine content archives load. The .SKP payloads are intact and expandable; SOUND.SKI alone holds 1.01 GB.
  • HShield can be taken out of the launch path and the client still starts.
  • Offline mode is a retail switch. The client accepts -NoneNetwork 1 and reached its attract and venue scenes with no server anywhere.
  • The failure is not the content. The same archives that fault on one run render a full loading dock with shadows and daylight on another.

Not yet

  • It is not playable yet. No song has been started, no chart played, no score produced, no key press has reached a note.
  • No connection has ever completed. Nothing but Wine's own ConnectNamedPipe appears in any trace — the client has never opened a TCP socket to anything.
  • It crashes intermittently. Of the 15 runs that reached the main loop, 8 died with a page fault and 1 aborted inside Wine. Same build, different outcomes.
  • The fault is undiagnosed. Two of the three fault sites dereference a near-null pointer (0x1 and 0x48), which points at client code rather than a missing asset — but that is where the analysis stops.
  • No server exists to talk to. The retail endpoints are dead; nothing has been written to answer them.

The crash, measured

18 of 41 runs ended in an unhandled page fault. The addresses cluster into 4 sites, and the same build reaches those sites on some runs and survives them on others.

Fault addressAccessRunsSeen in
0048F7C2read13AUD-20260922-212706, MDX-20260922-212149, av1a-20260922-225338, av1b-20260922-225359, c3-20260922-222924, dbg-20260922-225214, nB-20260922-224916, nn0-20260922-225235, noarg-20260922-225115, seh3-20260922-223642, shd3-20260922-223850, sko-20260922-224417, t3force-20260922-222235
00491E94read2c2-20260922-222843, t2-20260922-222422
0062CDE4read2c6-20260922-223006, t6-20260922-222503
00A0232Fread1NOCRT-20260922-211805

Two of the four sites dereference a pointer that is only 1 or 0x48 bytes away from null. That is the signature of uninitialised pointer use inside the client, not of a missing or corrupt asset — the same archives render fine on the runs that survive. What triggers it is not yet known; we have deliberately not written a cause we cannot show.

A note on a red herring we chased and dropped: Wine also logs a DRI3 error, but it appears in only 5 of the 18 faulting runs and 2 of the clean ones, so it does not explain the crashes.

Verbatim from the logs

Unedited lines out of the trace files, one per distinct failure.

wine exceptionfirst seen in run HS2-20260922-211358
Unhandled exception 0xc000000d in thread 13c at address 009CE30E
page faultfirst seen in run NOCRT-20260922-211805
Unhandled page fault on read access to 75305C08 at address 00A0232F (thread 013c)
page faultfirst seen in run MDX-20260922-212149
Unhandled page fault on read access to 00000001 at address 0048F7C2 (thread 013c)
wine abort (glibc)first seen in run nonet-20260922-215231
Fatal glibc error: pthread_mutex_lock.c:436 (__pthread_mutex_lock_full): assertion failed: robust || (oldval & FUTEX_OWNER_DIED) == 0
page faultfirst seen in run t3force-20260922-222235
Unhandled page fault on read access to 00000001 at address 0048F7C2 (thread 0140)
page faultfirst seen in run t2-20260922-222422
Unhandled page fault on read access to 00000048 at address 00491E94 (thread 0140)
page faultfirst seen in run t6-20260922-222503
Unhandled page fault on read access to 00000048 at address 0062CDE4 (thread 013c)
page faultfirst seen in run c2-20260922-222843
Unhandled page fault on read access to 00000048 at address 00491E94 (thread 013c)
page faultfirst seen in run c6-20260922-223006
Unhandled page fault on read access to 00000048 at address 0062CDE4 (thread 0144)

Every run we have

All 41 recorded runs, oldest first. "No crash line" means exactly that — no fault, exception or abort was logged, which includes runs the harness killed on a timeout while the client was still alive.

RunStartedLog linesReachedOutcomeFault addr
20260922-20334809-22 20:33:4812start-up bailno crash line
20260922-20353009-22 20:35:3023start-up bailno crash line
A-20260922-20374209-22 20:37:4223start-up bailno crash line
B-20260922-20382009-22 20:38:20154early stageno crash line
HW-20260922-20401409-22 20:40:1447start-up bailno crash line
HSOFF-20260922-20490109-22 20:49:0122start-up bailno crash line
FINE-20260922-20505409-22 20:50:5422start-up bailno crash line
PATCH1-20260922-20583409-22 20:58:3422start-up bailno crash line
DEVARG-20260922-21035109-22 21:03:5130start-up bailno crash line
HS2-20260922-21135809-22 21:13:5883early stagewine exception009CE30E
NOCRT-20260922-21180509-22 21:18:0587early stagepage fault00A0232F
MDX-20260922-21214909-22 21:21:49333main looppage fault0048F7C2
HWW-20260922-21250509-22 21:25:0514,957main loopno crash line
AUD-20260922-21270609-22 21:27:067,292main looppage fault0048F7C2
run-20260922-21442109-22 21:44:2121start-up bailno crash line
devlogin-20260922-21503109-22 21:50:31596main loopno crash line
nonet-20260922-21523109-22 21:52:312,452main loopwine abort (glibc)
t3site-20260922-22214909-22 22:21:49324main loopno crash line
t3force-20260922-22223509-22 22:22:35336main looppage fault0048F7C2
t2-20260922-22242209-22 22:24:22335main looppage fault00491E94
t6-20260922-22250309-22 22:25:03335main looppage fault0062CDE4
t9-20260922-22254509-22 22:25:45331main loopno crash line
c2-20260922-22284309-22 22:28:43336main looppage fault00491E94
c3-20260922-22292409-22 22:29:24325main looppage fault0048F7C2
c6-20260922-22300609-22 22:30:06337main looppage fault0062CDE4
c9-20260922-22304709-22 22:30:47331main loopno crash line
c9b-20260922-22322809-22 22:32:28329main loopno crash line
net1-20260922-22344709-22 22:34:47324main loopno crash line
seh3-20260922-22364209-22 22:36:4211,553main looppage fault0048F7C2
shd3-20260922-22385009-22 22:38:50336main looppage fault0048F7C2
sko-20260922-22441709-22 22:44:17336main looppage fault0048F7C2
ini1-20260922-22470209-22 22:47:0231start-up bailno crash line
ini2-20260922-22474109-22 22:47:4133start-up bailno crash line
nolog-20260922-22481509-22 22:48:1532start-up bailno crash line
nA-20260922-22485509-22 22:48:5530start-up bailno crash line
nB-20260922-22491609-22 22:49:16336main looppage fault0048F7C2
noarg-20260922-22511509-22 22:51:15336main looppage fault0048F7C2
dbg-20260922-22521409-22 22:52:14336main looppage fault0048F7C2
nn0-20260922-22523509-22 22:52:35336main looppage fault0048F7C2
av1a-20260922-22533809-22 22:53:38333main looppage fault0048F7C2
av1b-20260922-22535909-22 22:53:59336main looppage fault0048F7C2
Final log line of each run
  • 20260922-203348 01b4:fixme:toolhelp:CreateToolhelp32Snapshot Unimplemented: heap list snapshot
  • 20260922-203530 013c:fixme:toolhelp:CreateToolhelp32Snapshot Unimplemented: heap list snapshot
  • A-20260922-203742 013c:fixme:toolhelp:CreateToolhelp32Snapshot Unimplemented: heap list snapshot
  • B-20260922-203820 0124:fixme:event:X11DRV_ConfigureNotify synthetic event mapping not implemented
  • HW-20260922-204014 013c:fixme:msvcrt:__clean_type_info_names_internal (75642C5C) stub
  • HSOFF-20260922-204901 0128:fixme:event:X11DRV_ConfigureNotify synthetic event mapping not implemented
  • FINE-20260922-205054 0128:fixme:event:X11DRV_ConfigureNotify synthetic event mapping not implemented
  • PATCH1-20260922-205834 0128:fixme:event:X11DRV_ConfigureNotify synthetic event mapping not implemented
  • DEVARG-20260922-210351 Current serial number in output stream: 163
  • HS2-20260922-211358 wine: Unhandled exception 0xc000000d in thread 13c at address 009CE30E (thread 013c), starting debugger...
  • NOCRT-20260922-211805 wine: Unhandled page fault on read access to 75305C08 at address 00A0232F (thread 013c), starting debugger...
  • MDX-20260922-212149 wine: Unhandled page fault on read access to 00000001 at address 0048F7C2 (thread 013c), starting debugger...
  • HWW-20260922-212505 013c:fixme:msvcrt:__clean_type_info_names_internal (75652C5C) stub
  • AUD-20260922-212706 0160:trace:mmdevapi:render_ReleaseBuffer (1BCC2B78)->(480, 0)
  • run-20260922-214421 0128:fixme:event:X11DRV_ConfigureNotify synthetic event mapping not implemented
  • devlogin-20260922-215031 Current serial number in output stream: 22278
  • nonet-20260922-215231 Fatal glibc error: pthread_mutex_lock.c:436 (__pthread_mutex_lock_full): assertion failed: robust || (oldval & FUTEX_OWNER_DIED) == 0
  • t3site-20260922-222149 0178:fixme:winmm:MXD_SetControlDetails What should the sw-side mixer controls map to?
  • t3force-20260922-222235 Current serial number in output stream: 157
  • t2-20260922-222422 018c:fixme:x11drv:X11DRV_DestroyNotify window 0x10126/3800002 destroyed from the outside
  • t6-20260922-222503 Current serial number in output stream: 160
  • t9-20260922-222545 Current serial number in output stream: 17145
  • c2-20260922-222843 Current serial number in output stream: 157
  • c3-20260922-222924 wine: Unhandled page fault on read access to 00000001 at address 0048F7C2 (thread 013c), starting debugger...
  • c6-20260922-223006 Current serial number in output stream: 148
  • c9-20260922-223047 Current serial number in output stream: 9827
  • c9b-20260922-223228 Current serial number in output stream: 12369
  • net1-20260922-223447 0174:fixme:winmm:MXD_SetControlDetails What should the sw-side mixer controls map to?
  • seh3-20260922-223642 Current serial number in output stream: 157
  • shd3-20260922-223850 Current serial number in output stream: 157
  • sko-20260922-224417 Current serial number in output stream: 157
  • ini1-20260922-224702 Current serial number in output stream: 194
  • ini2-20260922-224741 Current serial number in output stream: 194
  • nolog-20260922-224815 Current serial number in output stream: 194
  • nA-20260922-224855 Current serial number in output stream: 194
  • nB-20260922-224916 Current serial number in output stream: 157
  • noarg-20260922-225115 Current serial number in output stream: 157
  • dbg-20260922-225214 Current serial number in output stream: 157
  • nn0-20260922-225235 Current serial number in output stream: 157
  • av1a-20260922-225338 018c:fixme:x11drv:X11DRV_DestroyNotify window 0x10122/2600002 destroyed from the outside
  • av1b-20260922-225359 Current serial number in output stream: 157

What the renderer actually draws

Every frame below is cropped to exactly the client's own 1024×720 window — no desktop, no Wine chrome, nothing outside what the game itself put on screen. Captions describe only what is visible in the frame.

The client tree

2.98 GB in place under client/offline/. The retail reference tree is 2.85 GB; the growth over retail is our own added files, not new game content.

Content archives

ArchivePayload bytes
Data/ANIMATION.SKI193,680,164193.7 MB
Data/AVATAR.SKI424,569,493424.6 MB
Data/EFFECT.SKI36,819,01736.8 MB
Data/SCRIPT.SKI37,876,20137.9 MB
Data/SG.SKI203,085,465203.1 MB
Data/SHADERS.SKI2,364,6222.4 MB
Data/SOUND.SKI1,015,127,8671015.1 MB
Data/SYSTEM.SKI187,1700.2 MB
Data/WORLD.SKI649,690,290649.7 MB

2,563,400,289 bytes of payload across 9 archives.

Executables

FileBytes
ffmpeg.exe14,604,80014.6 MB
SUPERSTARLIVE.EXE9,818,1129.8 MB
SSKOPatch.exe9,103,3609.1 MB
SSKOLAUNCHER.EXE9,103,3609.1 MB
SSKOClean.exe3,998,2084.0 MB
vcredist_x86.exe2,742,1842.7 MB
SSLManualPatcher.exe2,379,7762.4 MB
SSKOHWWizard.exe1,376,7681.4 MB
HShield.DISABLED/AhnRpt.exe1,131,7761.1 MB
dxwebsetup.exe299,8640.3 MB
lame.exe195,0720.2 MB
HShield.DISABLED/Update/autoup.exe188,4880.2 MB
HShield.DISABLED/HSUpdate.exe159,0720.2 MB
oggenc.exe155,1360.2 MB
HShield.DISABLED/HsLogMgr.exe113,3440.1 MB
oggdec.exe74,2400.1 MB

Launch target: SUPERSTARLIVE.EXE (9,818,112 bytes).

What the offline copy adds

The patched tree measures 2.98 GB against retail's 2.85 GB — 127.7 MB larger. Every byte of that growth is accounted for by 15 files that do not exist in the retail tree, and all of them are ours:

File present only in client/offline/Bytes
SUPERSTARLIVE.EXE.orig9,818,112
SUPERSTARLIVE.EXE.patched19,818,112
SUPERSTARLIVE_AV1.EXE9,818,112
SUPERSTARLIVE_DEV.EXE9,818,112
SUPERSTARLIVE_OFF.EXE9,818,112
SUPERSTARLIVE_OFF3.EXE9,818,112
SUPERSTARLIVE_OFF9.EXE9,818,112
SUPERSTARLIVE_T2.EXE9,818,112
SUPERSTARLIVE_T3.EXE9,818,112
SUPERSTARLIVE_T3force.EXE9,818,112
SUPERSTARLIVE_T3site.EXE9,818,112
SUPERSTARLIVE_T6.EXE9,818,112
SUPERSTARLIVE_T9.EXE9,818,112
backtrace.txt5,824
OutputMixer.ini284

127.6 MB of added files against a measured 127.7 MB tree delta. Eight of those files are same-size (9,818,112-byte) copies of the client executable, staged while testing patches, plus one captured backtrace and one small audio config. No new game content, no added music or charts.

What we changed, and why

Every bypass is small, reversible and written down. Nothing here edits the retail tree.

HShield anti-cheat

The AhnLab HShield product ships alongside the client. It is moved out of the launch path (HShield.DISABLED/), and the client starts without it. Its log is 17,556,652 bytes.

Command line

The offline copy's cmdline.ini differs from the retail copy by exactly one line — the value of the retail offline switch, -NoneNetwork, set to 1. Every other switch, including the -DumpServerIP test hook and -Location SG, is the retail build's own.

-NoneNetwork
1

-Packing
1

-UsedDebugKey
0

-ActiveVisibleUIKey
0

-Location
SG

-DumpServerIP
[address withheld]

-RoomType
2

Hosts file

No entries were added. Nothing in the client's start-up path depends on a hostname resolving.

How it is launched

The harness runs SUPERSTARLIVE.EXE inside a Wine virtual desktop, so the client believes it has a fixed display and we get a predictable capture surface. Screenshots are taken by frame number from the harness.

Reproducing this page

Nothing on it is typed by hand. The numbers come from:

python3 tools/site-build.py    # reads artifacts/ + client/ -> website/data/facts.json
python3 tools/render-site.py   # facts.json + frames.json -> index.html

Frame captions live in website/frames.json and are written from a full-resolution look at each frame. Generated 2026-09-23 03:12 UTC.

What happens next

  1. Pin the crash. Reproduce it under a debugger and get a backtrace, so the two near-null dereferences become a named function instead of an address.
  2. Get a socket on the wire. Stand up a loopback listener, point the client at it, and capture the first bytes it sends to the login port — the real protocol evidence this project does not have yet.
  3. Answer login and the channel list. Enough of a shim for the client to reach the lobby, then the song select, then a single chart.
  4. One song, offline. The finish line: boot, log in, pick one track, hear it play and see a score at the end.

Nothing on this page claims to be further along than that.