pNES5

NES emulator for PS5 as native x86_64 shellcode, running through LuaC0re (no kernel exploit). Tested up to firmware 13.60; see the community test details below.

Forked from EmuC0re (EgyDevTeam / egycnq). Same LuaC0re shellcode approach; this repo focuses on a single NES host with tighter APU/PPU behavior, DualSense controls, and an in-game settings menu.

Features

• Full 6502 (including illegals)
• PPU: scrolling, sprites, sprite 0
• APU at 48 kHz (vsync-friendly buffering)
• DualSense (native)
• FTP ROM upload, library picker, save states
• Settings: pixel-perfect / stretch / 2×–4× scale, turbo rate, reset

Mappers

Logic is in src/mapper.c. The bus only dispatches.

#	Name	Notes
0	NROM
1	MMC1	Consecutive-write filter, PRG-RAM disable
2	UxROM
3	CNROM
4	MMC3	A12 + scanline IRQ, WRAM protect, four-screen
7	AxROM
9	MMC2
10	MMC4
11	Color Dreams
13	CPROM	4KB CHR-RAM at $1000
34	BNROM / NINA-001	$8000 BNROM + $7FFD–7FFF NINA
66	GxROM
69	FME-7	PRG slots, $6000 ROM/RAM, CPU IRQ
70	Bandai 74161
71	Camerica
78	Irem / Holy Diver
79	NINA-03/06
87	J87
93	Sunsoft-2
94	UxROM V
113	NINA-03/06	+ mirroring
140	Jaleco JF-11
152	Bandai 74161
180	Inv UxROM
185	CNROM CP	CHR disable / open bus
206	DxROM

Unsupported mappers will not run. MMC3 scanline IRQ is approximate (blargg 4-scanline_timing fails). MMC6-only WRAM tests are incomplete.

Requirements

• PS5 (tested through 13.60; see the configuration below)
• LuaC0re
• Star Wars Racer Revenge — US CUSA03474 or EU CUSA03492
• Python 3 on the PC, same LAN as the console

Community compatibility test

A successful launch and game test was reported on PS5 firmware 13.60 with the EU version of Star Wars Racer Revenge (CUSA03492). The launcher connected to the emulator's FTP server and uploaded a ROM, and the tester confirmed that the game worked. This is a single-configuration smoke test, not validation of every game, feature, region, or intervening firmware version.

The tested setup required the Lua compatibility changes in this payload: a local hex decoder, jit_write_buffer instead of write_shellcode, and a write8 loop instead of memset. The exact installed Luac0re version was not verified. The native emulator binary was unchanged.

Build & launch

make clean && make
make payload          # embed nes_emu.bin into nes.lua (sc=)

Or:

python pnes5.py config --ps5 192.168.1.50
python pnes5.py run --build --log
python pnes5.py upload
python pnes5.py log

pnes5.py patches PC_IP in the payload for UDP logs on port 9027, stores settings in .pnes5.json, and skips ROM uploads that are already on the console.

Legacy: python nes_launcher.py <PS5_IP> still works.

Host tests (no PS5)

make test
make romtest
./tests/nes_romtest path/to/test.nes --frames 600 --expect-pass
./tests/nes_romtest path/to/nestest.nes --nestest --steps 8991

Usage

Put .nes files in roms/ next to the CLI; the launcher FTPs them after the payload starts (port 1337). You can also drop ROMs into the savedata path and refresh the library with L1.

Optional UDP log: set PC_IP in nes.lua, then nc -u -l -p 9027 or python pnes5.py log.

Controls

Library

Input	Action
D-Pad	Navigate
Cross / Start	Launch
L1	Rescan ROMs on disk
R1	Exit

In-game

DualSense	Action
Cross	A
Circle	B
Square	Turbo A
Triangle	Turbo B
Create / Touch pad	Select
Options	Start
D-Pad	D-Pad
L2 / R2	Save / load state (edge)
L1	Library
R1	Settings
L3 + R3	Soft reset

Settings (R1) — scale (pixel perfect / stretch / 2×–4×), turbo rate, save/load, reset, library, exit. Cross confirms, Circle closes, Left/Right change values.

TODO

• More mappers (VRC2/4/6, MMC5, Namco 163, …)
• Cycle-accurate MMC3 A12 during rendering

Credits

• EmuC0re — EgyDevTeam / egycnq, with Abkarino
• Gezine — LuaC0re
• CTurt, McCaulay — mast1c0re
• ChampionLeake — Racer Revenge notes on psdevwiki
• shahrilnet, null_ptr
• NESDev, nondebug/dualsense

Disclaimer

Research / educational use only. Use at your own risk.

Русский

pNES5 — эмулятор NES для PS5 в виде нативного x86-64 shellcode, запускаемого через LuaC0re.

MIT относится только к авторскому коду; лицензии сторонних компонентов сохраняются.