Where it actually stands
This page is generated from the project's own artifacts — 41 Wine trace logs, 13 captured frames and a diffed client tree. Where something is not yet true, it says so.
Verified working
- The client boots under Wine and draws its own 3D — the CHOROCK GAMES splash, a lit pre-login room with a working account form, and full venue interiors.
- All nine content archives load. The .SKP payloads are intact and expandable; SOUND.SKI alone holds 1.01 GB.
- HShield can be taken out of the launch path and the client still starts.
- Offline mode is a retail switch. The client accepts
-NoneNetwork 1and reached its attract and venue scenes with no server anywhere. - The failure is not the content. The same archives that fault on one run render a full loading dock with shadows and daylight on another.
Not yet
- It is not playable yet. No song has been started, no chart played, no score produced, no key press has reached a note.
- No connection has ever completed. Nothing but Wine's own
ConnectNamedPipeappears in any trace — the client has never opened a TCP socket to anything. - It crashes intermittently. Of the 15 runs that reached the main loop, 8 died with a page fault and 1 aborted inside Wine. Same build, different outcomes.
- The fault is undiagnosed. Two of the three fault sites dereference a near-null pointer (0x1 and 0x48), which points at client code rather than a missing asset — but that is where the analysis stops.
- No server exists to talk to. The retail endpoints are dead; nothing has been written to answer them.
The crash, measured
18 of 41 runs ended in an unhandled page fault. The addresses cluster into 4 sites, and the same build reaches those sites on some runs and survives them on others.
| Fault address | Access | Runs | Seen in |
|---|---|---|---|
| 0048F7C2 | read | 13 | AUD-20260922-212706, MDX-20260922-212149, av1a-20260922-225338, av1b-20260922-225359, c3-20260922-222924, dbg-20260922-225214, nB-20260922-224916, nn0-20260922-225235, noarg-20260922-225115, seh3-20260922-223642, shd3-20260922-223850, sko-20260922-224417, t3force-20260922-222235 |
| 00491E94 | read | 2 | c2-20260922-222843, t2-20260922-222422 |
| 0062CDE4 | read | 2 | c6-20260922-223006, t6-20260922-222503 |
| 00A0232F | read | 1 | NOCRT-20260922-211805 |
Two of the four sites dereference a pointer that is only 1 or 0x48 bytes away from null. That is the signature of uninitialised pointer use inside the client, not of a missing or corrupt asset — the same archives render fine on the runs that survive. What triggers it is not yet known; we have deliberately not written a cause we cannot show.
A note on a red herring we chased and dropped: Wine also logs a DRI3 error, but it appears in only 5 of the 18 faulting runs and 2 of the clean ones, so it does not explain the crashes.
Verbatim from the logs
Unedited lines out of the trace files, one per distinct failure.
Unhandled exception 0xc000000d in thread 13c at address 009CE30EUnhandled page fault on read access to 75305C08 at address 00A0232F (thread 013c)Unhandled page fault on read access to 00000001 at address 0048F7C2 (thread 013c)Fatal glibc error: pthread_mutex_lock.c:436 (__pthread_mutex_lock_full): assertion failed: robust || (oldval & FUTEX_OWNER_DIED) == 0Unhandled page fault on read access to 00000001 at address 0048F7C2 (thread 0140)Unhandled page fault on read access to 00000048 at address 00491E94 (thread 0140)Unhandled page fault on read access to 00000048 at address 0062CDE4 (thread 013c)Unhandled page fault on read access to 00000048 at address 00491E94 (thread 013c)Unhandled page fault on read access to 00000048 at address 0062CDE4 (thread 0144)Every run we have
All 41 recorded runs, oldest first. "No crash line" means exactly that — no fault, exception or abort was logged, which includes runs the harness killed on a timeout while the client was still alive.
| Run | Started | Log lines | Reached | Outcome | Fault addr |
|---|---|---|---|---|---|
| 20260922-203348 | 09-22 20:33:48 | 12 | start-up bail | no crash line | — |
| 20260922-203530 | 09-22 20:35:30 | 23 | start-up bail | no crash line | — |
| A-20260922-203742 | 09-22 20:37:42 | 23 | start-up bail | no crash line | — |
| B-20260922-203820 | 09-22 20:38:20 | 154 | early stage | no crash line | — |
| HW-20260922-204014 | 09-22 20:40:14 | 47 | start-up bail | no crash line | — |
| HSOFF-20260922-204901 | 09-22 20:49:01 | 22 | start-up bail | no crash line | — |
| FINE-20260922-205054 | 09-22 20:50:54 | 22 | start-up bail | no crash line | — |
| PATCH1-20260922-205834 | 09-22 20:58:34 | 22 | start-up bail | no crash line | — |
| DEVARG-20260922-210351 | 09-22 21:03:51 | 30 | start-up bail | no crash line | — |
| HS2-20260922-211358 | 09-22 21:13:58 | 83 | early stage | wine exception | 009CE30E |
| NOCRT-20260922-211805 | 09-22 21:18:05 | 87 | early stage | page fault | 00A0232F |
| MDX-20260922-212149 | 09-22 21:21:49 | 333 | main loop | page fault | 0048F7C2 |
| HWW-20260922-212505 | 09-22 21:25:05 | 14,957 | main loop | no crash line | — |
| AUD-20260922-212706 | 09-22 21:27:06 | 7,292 | main loop | page fault | 0048F7C2 |
| run-20260922-214421 | 09-22 21:44:21 | 21 | start-up bail | no crash line | — |
| devlogin-20260922-215031 | 09-22 21:50:31 | 596 | main loop | no crash line | — |
| nonet-20260922-215231 | 09-22 21:52:31 | 2,452 | main loop | wine abort (glibc) | — |
| t3site-20260922-222149 | 09-22 22:21:49 | 324 | main loop | no crash line | — |
| t3force-20260922-222235 | 09-22 22:22:35 | 336 | main loop | page fault | 0048F7C2 |
| t2-20260922-222422 | 09-22 22:24:22 | 335 | main loop | page fault | 00491E94 |
| t6-20260922-222503 | 09-22 22:25:03 | 335 | main loop | page fault | 0062CDE4 |
| t9-20260922-222545 | 09-22 22:25:45 | 331 | main loop | no crash line | — |
| c2-20260922-222843 | 09-22 22:28:43 | 336 | main loop | page fault | 00491E94 |
| c3-20260922-222924 | 09-22 22:29:24 | 325 | main loop | page fault | 0048F7C2 |
| c6-20260922-223006 | 09-22 22:30:06 | 337 | main loop | page fault | 0062CDE4 |
| c9-20260922-223047 | 09-22 22:30:47 | 331 | main loop | no crash line | — |
| c9b-20260922-223228 | 09-22 22:32:28 | 329 | main loop | no crash line | — |
| net1-20260922-223447 | 09-22 22:34:47 | 324 | main loop | no crash line | — |
| seh3-20260922-223642 | 09-22 22:36:42 | 11,553 | main loop | page fault | 0048F7C2 |
| shd3-20260922-223850 | 09-22 22:38:50 | 336 | main loop | page fault | 0048F7C2 |
| sko-20260922-224417 | 09-22 22:44:17 | 336 | main loop | page fault | 0048F7C2 |
| ini1-20260922-224702 | 09-22 22:47:02 | 31 | start-up bail | no crash line | — |
| ini2-20260922-224741 | 09-22 22:47:41 | 33 | start-up bail | no crash line | — |
| nolog-20260922-224815 | 09-22 22:48:15 | 32 | start-up bail | no crash line | — |
| nA-20260922-224855 | 09-22 22:48:55 | 30 | start-up bail | no crash line | — |
| nB-20260922-224916 | 09-22 22:49:16 | 336 | main loop | page fault | 0048F7C2 |
| noarg-20260922-225115 | 09-22 22:51:15 | 336 | main loop | page fault | 0048F7C2 |
| dbg-20260922-225214 | 09-22 22:52:14 | 336 | main loop | page fault | 0048F7C2 |
| nn0-20260922-225235 | 09-22 22:52:35 | 336 | main loop | page fault | 0048F7C2 |
| av1a-20260922-225338 | 09-22 22:53:38 | 333 | main loop | page fault | 0048F7C2 |
| av1b-20260922-225359 | 09-22 22:53:59 | 336 | main loop | page fault | 0048F7C2 |
Final log line of each run
- 20260922-203348
01b4:fixme:toolhelp:CreateToolhelp32Snapshot Unimplemented: heap list snapshot - 20260922-203530
013c:fixme:toolhelp:CreateToolhelp32Snapshot Unimplemented: heap list snapshot - A-20260922-203742
013c:fixme:toolhelp:CreateToolhelp32Snapshot Unimplemented: heap list snapshot - B-20260922-203820
0124:fixme:event:X11DRV_ConfigureNotify synthetic event mapping not implemented - HW-20260922-204014
013c:fixme:msvcrt:__clean_type_info_names_internal (75642C5C) stub - HSOFF-20260922-204901
0128:fixme:event:X11DRV_ConfigureNotify synthetic event mapping not implemented - FINE-20260922-205054
0128:fixme:event:X11DRV_ConfigureNotify synthetic event mapping not implemented - PATCH1-20260922-205834
0128:fixme:event:X11DRV_ConfigureNotify synthetic event mapping not implemented - DEVARG-20260922-210351
Current serial number in output stream: 163 - HS2-20260922-211358
wine: Unhandled exception 0xc000000d in thread 13c at address 009CE30E (thread 013c), starting debugger... - NOCRT-20260922-211805
wine: Unhandled page fault on read access to 75305C08 at address 00A0232F (thread 013c), starting debugger... - MDX-20260922-212149
wine: Unhandled page fault on read access to 00000001 at address 0048F7C2 (thread 013c), starting debugger... - HWW-20260922-212505
013c:fixme:msvcrt:__clean_type_info_names_internal (75652C5C) stub - AUD-20260922-212706
0160:trace:mmdevapi:render_ReleaseBuffer (1BCC2B78)->(480, 0) - run-20260922-214421
0128:fixme:event:X11DRV_ConfigureNotify synthetic event mapping not implemented - devlogin-20260922-215031
Current serial number in output stream: 22278 - nonet-20260922-215231
Fatal glibc error: pthread_mutex_lock.c:436 (__pthread_mutex_lock_full): assertion failed: robust || (oldval & FUTEX_OWNER_DIED) == 0 - t3site-20260922-222149
0178:fixme:winmm:MXD_SetControlDetails What should the sw-side mixer controls map to? - t3force-20260922-222235
Current serial number in output stream: 157 - t2-20260922-222422
018c:fixme:x11drv:X11DRV_DestroyNotify window 0x10126/3800002 destroyed from the outside - t6-20260922-222503
Current serial number in output stream: 160 - t9-20260922-222545
Current serial number in output stream: 17145 - c2-20260922-222843
Current serial number in output stream: 157 - c3-20260922-222924
wine: Unhandled page fault on read access to 00000001 at address 0048F7C2 (thread 013c), starting debugger... - c6-20260922-223006
Current serial number in output stream: 148 - c9-20260922-223047
Current serial number in output stream: 9827 - c9b-20260922-223228
Current serial number in output stream: 12369 - net1-20260922-223447
0174:fixme:winmm:MXD_SetControlDetails What should the sw-side mixer controls map to? - seh3-20260922-223642
Current serial number in output stream: 157 - shd3-20260922-223850
Current serial number in output stream: 157 - sko-20260922-224417
Current serial number in output stream: 157 - ini1-20260922-224702
Current serial number in output stream: 194 - ini2-20260922-224741
Current serial number in output stream: 194 - nolog-20260922-224815
Current serial number in output stream: 194 - nA-20260922-224855
Current serial number in output stream: 194 - nB-20260922-224916
Current serial number in output stream: 157 - noarg-20260922-225115
Current serial number in output stream: 157 - dbg-20260922-225214
Current serial number in output stream: 157 - nn0-20260922-225235
Current serial number in output stream: 157 - av1a-20260922-225338
018c:fixme:x11drv:X11DRV_DestroyNotify window 0x10122/2600002 destroyed from the outside - av1b-20260922-225359
Current serial number in output stream: 157
What the renderer actually draws
Every frame below is cropped to exactly the client's own 1024×720 window — no desktop, no Wine chrome, nothing outside what the game itself put on screen. Captions describe only what is visible in the frame.
The login screen, fully rendered
The whole client in one shot: a real 3D pre-login room with marble pillars, gold-trimmed doors, wall sconces and spotlights aimed back at the camera, plus floating light motes. The SUPER STAR LIVE logo sits above a working form - ACCOUNT NAME prefilled from the client's own config, 'Remember Account Name' ticked, PASSWORD field, LOG IN button. The small arrow labelled 'End' in the top right is the client's own quit affordance.
early boot captures, 20:33-20:35 · 1024×720
Login form, tight crop
The same pre-login room framed closer on the form. The 3D scene behind the panel is not a static backdrop: it carries real depth, specular highlights on the marble and lit sconces.
early boot captures, 20:33-20:35 · 1024×720
Login form, later in the run
Captured later in the same run. Scene and form are unchanged, which is the point: the screen is live and stable, not a frozen frame captured after a crash.
early boot captures, 20:33-20:35 · 1024×720
Pre-login room, wide view
The widest view of the pre-login room we captured: tiled floor, ornate doorways, the SUPER STAR LIVE emblem and the account panel.
early boot captures, 20:33-20:35 · 1024×720
Publisher splash - CHOROCK GAMES
The first thing the client draws: the CHOROCK GAMES publisher mark in a pink/red rounded logo on pure black. This is a 2D splash drawn before any 3D initialisation.
early boot captures, 20:33-20:35 · 1024×720
Black frame, ~5 s in
Honest caption: this is pure black. The process is alive and its log is advancing, but at this point in the run it has not put a single pixel on screen. Included because an honest timeline is not a highlight reel.
early boot captures, 20:33-20:35 · 1024×720
Attract sequence - the H3W mural
The venue's key art as a 3D wall: green 'H3W' graffiti with 'HYP' woven through it, flanked by two orange winged jack-o'-lantern faces, spray drips in red, on dark brick. Hanging steel cables and a ceiling rig frame the top; a backlit mesh barrier runs across the bottom. Note the speaker cabinets on the left: they render as magenta concentric rings rather than a grille texture, which is the kind of missing/placeholder texture worth investigating.
-NoneNetwork 1 run, 21:52 · 1024×720
H3W mural, from behind the barrier
The same wall, closer and from behind the mesh barrier, which is rendered blurred with red light bleeding through it. Under the mural you can see a large, faint ghosted face painted on the brick - a second layer of art. The two speaker cabinets again show magenta ring patterns instead of grille detail.
-NoneNetwork 1 run, 21:52 · 1024×720
The stage hall - 'SUPER STARKING'
A different room: an industrial stage hall with suspended line-array speaker stacks, a chain hoist rig and a yellow overhead gantry carrying the words SUPER STARKING. A giant H3W mural covers the far wall; pumpkins, green graffiti and scaffolding fill in the rest. This proves the content archives are intact beyond the single spawn room.
-NoneNetwork 1 run, 21:52 · 1024×720
Loading dock - real-time 3D with shadows
The most detailed room we captured: a warehouse loading dock with a yellow forklift (and a second one at frame left), stacked pallets, loose planks, blue oil drums, a roll-up shutter door under a graffiti tag with hazard chevrons, electrical distribution boxes on the brick wall, and sunlight shafts from the upper windows. A yellow-and-black striped packing machine at the left carries a partly-legible 'SUPERLON' label; box faces read 'SKO ACCESSORY'. The forklift casts a real shadow, the floor carries painted lane markings plus a large circular graffiti decal, and the foreground barrier is textured with a magenta checkered pattern that looks like a placeholder rather than art.
-NoneNetwork 1 run, 21:52 · 1024×720
Venue interior, third angle
Another angle across the venue: structural girders, the ceiling light rig and the mural wall receding into the dark. Same real-time renderer, no loading placeholder.
-NoneNetwork 1 run, 21:52 · 1024×720
Checkered floor, low light
A darker view from the same sequence - checkered flooring, the mural reduced to a shape at the top left, most of the frame falling away to black. It shows how aggressive the lighting falloff is at this stage.
-NoneNetwork 1 run, 21:52 · 1024×720
Black frame, ~5 s in (no-network run)
The equivalent near-black frame from the -NoneNetwork 1 run, for the same reason as above: an honest timeline is not a highlight reel.
-NoneNetwork 1 run, 21:52 · 1024×720The client tree
2.98 GB in place under client/offline/. The retail reference tree is
2.85 GB; the growth over retail is our own added files, not new game content.
Content archives
| Archive | Payload bytes | |
|---|---|---|
| Data/ANIMATION.SKI | 193,680,164 | 193.7 MB |
| Data/AVATAR.SKI | 424,569,493 | 424.6 MB |
| Data/EFFECT.SKI | 36,819,017 | 36.8 MB |
| Data/SCRIPT.SKI | 37,876,201 | 37.9 MB |
| Data/SG.SKI | 203,085,465 | 203.1 MB |
| Data/SHADERS.SKI | 2,364,622 | 2.4 MB |
| Data/SOUND.SKI | 1,015,127,867 | 1015.1 MB |
| Data/SYSTEM.SKI | 187,170 | 0.2 MB |
| Data/WORLD.SKI | 649,690,290 | 649.7 MB |
2,563,400,289 bytes of payload across 9 archives.
Executables
| File | Bytes | |
|---|---|---|
| ffmpeg.exe | 14,604,800 | 14.6 MB |
| SUPERSTARLIVE.EXE | 9,818,112 | 9.8 MB |
| SSKOPatch.exe | 9,103,360 | 9.1 MB |
| SSKOLAUNCHER.EXE | 9,103,360 | 9.1 MB |
| SSKOClean.exe | 3,998,208 | 4.0 MB |
| vcredist_x86.exe | 2,742,184 | 2.7 MB |
| SSLManualPatcher.exe | 2,379,776 | 2.4 MB |
| SSKOHWWizard.exe | 1,376,768 | 1.4 MB |
| HShield.DISABLED/AhnRpt.exe | 1,131,776 | 1.1 MB |
| dxwebsetup.exe | 299,864 | 0.3 MB |
| lame.exe | 195,072 | 0.2 MB |
| HShield.DISABLED/Update/autoup.exe | 188,488 | 0.2 MB |
| HShield.DISABLED/HSUpdate.exe | 159,072 | 0.2 MB |
| oggenc.exe | 155,136 | 0.2 MB |
| HShield.DISABLED/HsLogMgr.exe | 113,344 | 0.1 MB |
| oggdec.exe | 74,240 | 0.1 MB |
Launch target: SUPERSTARLIVE.EXE (9,818,112 bytes).
What the offline copy adds
The patched tree measures 2.98 GB against retail's 2.85 GB — 127.7 MB larger. Every byte of that growth is accounted for by 15 files that do not exist in the retail tree, and all of them are ours:
File present only in client/offline/ | Bytes |
|---|---|
| SUPERSTARLIVE.EXE.orig | 9,818,112 |
| SUPERSTARLIVE.EXE.patched1 | 9,818,112 |
| SUPERSTARLIVE_AV1.EXE | 9,818,112 |
| SUPERSTARLIVE_DEV.EXE | 9,818,112 |
| SUPERSTARLIVE_OFF.EXE | 9,818,112 |
| SUPERSTARLIVE_OFF3.EXE | 9,818,112 |
| SUPERSTARLIVE_OFF9.EXE | 9,818,112 |
| SUPERSTARLIVE_T2.EXE | 9,818,112 |
| SUPERSTARLIVE_T3.EXE | 9,818,112 |
| SUPERSTARLIVE_T3force.EXE | 9,818,112 |
| SUPERSTARLIVE_T3site.EXE | 9,818,112 |
| SUPERSTARLIVE_T6.EXE | 9,818,112 |
| SUPERSTARLIVE_T9.EXE | 9,818,112 |
| backtrace.txt | 5,824 |
| OutputMixer.ini | 284 |
127.6 MB of added files against a measured 127.7 MB tree delta. Eight of those files are same-size (9,818,112-byte) copies of the client executable, staged while testing patches, plus one captured backtrace and one small audio config. No new game content, no added music or charts.
What we changed, and why
Every bypass is small, reversible and written down. Nothing here edits the retail tree.
HShield anti-cheat
The AhnLab HShield product ships alongside the client. It is moved out of the launch path
(HShield.DISABLED/), and the client starts without it. Its log is 17,556,652 bytes.
Command line
The offline copy's cmdline.ini differs from the retail copy by exactly one line — the value of the
retail offline switch, -NoneNetwork, set to 1. Every other switch, including the
-DumpServerIP test hook and -Location SG, is the retail build's own.
-NoneNetwork
1
-Packing
1
-UsedDebugKey
0
-ActiveVisibleUIKey
0
-Location
SG
-DumpServerIP
[address withheld]
-RoomType
2
Hosts file
No entries were added. Nothing in the client's start-up path depends on a hostname resolving.
How it is launched
The harness runs SUPERSTARLIVE.EXE inside a Wine virtual desktop, so the client believes it has a
fixed display and we get a predictable capture surface. Screenshots are taken by frame number from the harness.
Reproducing this page
Nothing on it is typed by hand. The numbers come from:
python3 tools/site-build.py # reads artifacts/ + client/ -> website/data/facts.json
python3 tools/render-site.py # facts.json + frames.json -> index.html
Frame captions live in website/frames.json and are written from a full-resolution look at each
frame. Generated 2026-09-23 03:12 UTC.
What happens next
- Pin the crash. Reproduce it under a debugger and get a backtrace, so the two near-null dereferences become a named function instead of an address.
- Get a socket on the wire. Stand up a loopback listener, point the client at it, and capture the first bytes it sends to the login port — the real protocol evidence this project does not have yet.
- Answer login and the channel list. Enough of a shim for the client to reach the lobby, then the song select, then a single chart.
- One song, offline. The finish line: boot, log in, pick one track, hear it play and see a score at the end.
Nothing on this page claims to be further along than that.